Access-Control-Allow CORS settings in config

Relating to #1944, a couple of config settings to control the Access-Control-Allow-Origin response header. To repeat the commit message:

> New config settings:
> ckan.cors.origin_allow_all = \<true|false\>
> ckan.cors.origin_whitelist = \<space separated list of allowable domain origins\>

> Access-Control-Allow headers will only be set in the response if the request contains an Origin header, the origin_allow_all setting is present, and either:

> a) the origin_allow_all setting is true, or
> b) the request origin is listed in the origin_whitelist setting

These will be sent for all responses that fit the above criteria. Do we want to restrict A-C-A-O to just api requests?
Right, my first impression was that setting one or the other will turn CORS on, either allowing it for all domains or just for the ones on the whitelist.