Support regular expression in origins list

This PR adds support for regular expressions in the origins list.

While everything works as you expect, there is one strange corner case which is influenced by a bad choice of  defaults (which I will correct in another PR soon, but it will require a major version bump, as it is not 100% backwards compatible).

The corner case occurs when the send_always setting is True. As there may not be an Origin header in the request, it is not possible to match the regular expression(s) to determine the correct Access-Control-Allow-Origin header to be returned.
Instead, the list of origins is serialized, and any strings which seem like regular expressions (e.g. are not a '*' and contain either '*' or '?') will be skipped. 

OriginsTestCase.test_regex_mixed_list attempts to disambiguate this behavior.