make CORS configurable

allows setting CORS headers.

- cors_origin sets Access-Control-Allow-Origin directly
- cors_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support complex access[1]
- cors_credentials sets Access-Control-Allow-Credentials: true

To allow CORS from everywhere:

    ipython notebook —NotebookApp.cors_origin='*'
s/cors_/allow_/

add notes about Tornado 4, and comments, updates per review
Fix NaN warnings and failures in test_serialize

don't use empty, which can create a bunch of NaNs,
causing equality tests to fail.
Add option to generate API docs based on __all__
Document IPython.display API correctly
Remove docstring_nbformat_mod decorator
Don't document a deprecated module
Move publish_display_data into IPython.display API
Add missed name in __all__
Merge pull request #6048 from takluyver/docs-exposed-api

Document objects in API location rather than where defined
allow unicode keys in dicts in json_clean
fix IPython embed documentation

Also clean up old comments and bring the style of this file up to
current standards
Merge pull request #6078 from ivanov/tiny-embed-cleanup

fix IPython embed documentation
don’t modify dict keys while iterating through them

in jsonutil.rekey
Remove some unhelpful info from IPython.core.completer
Add docstring for dict_key_matches
test rekey modify-in-place
persist notebook server cookie secret in security dir

prevents loss of login after relaunching the notebook server

closes #6075
Merge pull request #6083 from takluyver/completer-docstrings

Some docstring improvements in completer
Merge pull request #6081 from minrk/rekey-inplace

don’t modify dict keys while iterating through them