Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
I'd prefer to see this test and the previous test be merged into a table driven test, because there is more than one case where we want to allow or disallow CORS. For example, I don't think either one of these tests exercises the bug from the original loop where a false match against the last pattern would overwrite a successful match against a previous pattern. With a table driven test it's much easier to see what is being changed with each iteration and to test a wide variety of cases without adding a lot of code.