Optionally allow CORS access, based on env variables

Set up CORS, if the environment variable PORTAL_FEATURES includes "allow_cors".

If CORS is allowed, then by default, we will allow CORS requests only from the origin
`*.concord.org`. If we want to specify something else, use the environment variable
CORS_ORIGINS, specifying multiple origins: CORS_ORIGINS="x.concord.org y.z.example.com".

We can also set which resources we allow with the CORS_RESOURCES environment variable.
By default, this is '*'
Update readme to describe env variables and CORS