Add CORS Access-Control header.

Have the MetricsServlet send back the Access-Control-Allow-Origin header
so that the JSON output from the metrics servlet can be used in browser
based dashboards separate from the application.
Allow CORS origin to be configured.

If left unset, CORS headers are disabled.
Merge pull request #440 from wotifgroup/cross-origin

Add CORS Access-Control header.