Full Support of CORS Spec

Hi! **This isn't ready to merge** but I wanted to start a conversation around it. I apologize for leaving my [other PR](https://github.com/globocom/tornado-cors/pull/8) handging. I needed to get CORS into a project I'm working on quickly. The added overhead of supporting multiple Python versions was going to slow me down a bit so I wrote most of what's in this PR inside of the other project. I'd like to contribute the changes if y'all will accept them (after doc updates and fixing tests for Python 3.X, etc. of course). If this isn't a direction y'all would like to go, I totally understand.

Cheers.

Updates include:

##### Only include CORS headers when an ``Origin`` header is present in the request.
While an ``Origin`` header does not necessarily indicate a CORS request,
all CORS requests will contain an ``Origin`` header.

##### Support for the [Access-Control-Expose-Headers](http://www.w3.org/TR/cors/#access-control-expose-headers-response-header)

##### Support multiple origins with whitelist settings and regular expressions
This idea was borrowed from [django-cors-headers](https://github.com/ottoyiu/django-cors-headers#configuration).
While it isn't implemented exactly the same, the concept is very
similar.

##### Credential header on all CORS requests when set

##### Test cases and associated handlers are aimed at one specific use case.

#### Breaking Changes

Many of the settings attributes have updated names to more explicitly
link them to the headers they control. The catalyst for this was
supporting both Allow-Headers and Expose-Headers.