enable hairpin mode on virtual interface bridge port

This is to support being able to DNAT/MASQ traffic from a container back into itself (dotcloud/docker#4442)

See subsequent pull request on docker project for details.
Do we want to fail the creation if hairpin mode isn't enabled or failed to be setup?
Can we log and forgive?