Access-Control-Allow CORS settings in config

Relating to #1944, a couple of config settings to control the Access-Control-Allow-Origin response header. To repeat the commit message:

> New config settings:
> ckan.cors.origin_allow_all = \<true|false\>
> ckan.cors.origin_whitelist = \<space separated list of allowable domain origins\>

> Access-Control-Allow headers will only be set in the response if the request contains an Origin header, the origin_allow_all setting is present, and either:

> a) the origin_allow_all setting is true, or
> b) the request origin is listed in the origin_whitelist setting

These will be sent for all responses that fit the above criteria. Do we want to restrict A-C-A-O to just api requests?
OK, so if you want to use `ckan.cors.origin_whitelist` you still need to set `ckan.cors.origin_allow_all` to `false`?