Adding optional CORS support to REST api

Introducing 'rest_enable_cors' configuration flag which is false per
default. Setting it to true enables the CORS filter for the request
pipeline which adds headers to each response which are needed to allow
modern browsers to do cross origin requests. Right now the allowed
origin is copied from the origin-header supplied by the client. This is
not a security issue as there is an additional, stateless layer of
authentication (basic auth).