Add CORS Access-Control header.

Have the MetricsServlet send back the Access-Control-Allow-Origin header
so that the JSON output from the metrics servlet can be used in browser
based dashboards separate from the application.
Add charset option for Graphite client.

Fixes #441.
Allow CORS origin to be configured.

If left unset, CORS headers are disabled.
Merge pull request #440 from wotifgroup/cross-origin

Add CORS Access-Control header.