Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
You check 'allowed' to set response headers but never reject any requests (everything falls through to the next handler):

1. If we are enforcing CORS and the "Origin" field in the header isn't set, should we accept or reject the request? I think we are trusting web browsers to implement the standard by letting through requests that don't set this field, which means that older browsers defeat the server side protections (http://caniuse.com/#feat=cors).

2. If the Origin header is set but it doesn't match any of the patterns, we should return an error (403?).