Introducing CORS support.

This is a minimum viable solution in order to get cors support working in cougar.

It is meant for discussion and to help improve getting to a good enough state to be merged.
Default value for an open source project should not be bf-specific, the default allowed origins should be blank and this should mean nothing. Not sure what benefit cors being enabled/not adds if you can just set this to an empty string which effectively disables?