Enable CORS of /csrfToken for whitelisted origins

Allows sails.config.csrf.allowCORS to be set (boolean) in order to specify whether or not you would like /csrfToken to be accessible in cross-domain AJAX requests. Prior to this fix, all CORS requsts to /csrfToken returned a null CSRF token.