Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
This still makes me a bit uncomfortable (how much do we trust non-browser clients anyway) but it seems to be the standard way CORS works and we should trust that folks who enable CORS know what they are doing.