Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
I would argue against rejecting at the server strictly based on Origin.  CORS headers are generally considered to be client-side enforcement.  Old browsers either a) don't allow cross-domain XmlHTTPRequests or b) allow them when the domains are explicitly added to a list of trusted domains.  In IE you can have a list of sites in the Trusted zone and anything in that list can talk cross-domain to anything else in that list (whether cors headers are there or not).