added --cors option to webapp to enable Cross-Origin Resource Sharing

Makes it possible to use JavaScript to access ports when the html page is
not provided by rock-webapp (e.g. by file://)

Also tried environment variable instad of global, but thought it whould be better to hav a single way to enable it
The enable_cors / cors_hosts variables are a bit of duplicate-use. Moreover, the --cors and non-cors codepaths are so different that they could easily diverge. You should probably use the same codepath (i.e. always use the WebApp class) as it has close to zero overhead.

```
class WebApp < Grape::API
end
if !cors_hosts.empty?
   ... do the CORS setup
end


```