Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
If the first pattern matches but the last one doesn't then allowed will be false at the end of this loop (but it should be true).