enabled CORS, set it as a configuration options, disabled by default

This pull request enables Strider users to use CORS if they choose to by explicitly enabling this feature, passing in the new configuration options:

* `enable_cors` - `false` by default
* `cors_allowed_domains`: `*` by default

I'm using Strider as a remote service from the browser. For this to work I have to enable CORS.
To enable CORS I needed to monkey-patch the middleware stack and stick a custom middleware that sets the right headers before any other middleware happens. Having this pull-request accepted means that I no longer have to do that.