Allow CORS origin to be configured.

If left unset, CORS headers are disabled.