CORS is now more compatible with browsers (Chrome).

Closes #408. This commit was carefully handcrafted while on flight to
EuroPython 2014.

Access-Control-Allow-Origin should ideally be able to use
a comma-separated list of origins, but that's currently not how browsers
do it. For example Chrome, returns the following error:

    XMLHttpRequest cannot load http://localhost:5000/people.
    The 'Access-Control-Allow-Origin' header contains multiple values
    'http://localhost:9000,http://google.no', but only one is allowed.
    Origin 'http://localhost:9000' is therefore not allowed access.

See the note under section 5.1 of the W3C CORS recommendation:
http://www.w3.org/TR/cors/#access-control-allow-origin-response-header

The documentation says

    Allowed values are: None, a list of domains or ‘*’ for a wide-open
    API.

But this is misleading for at least Chrome.

There I propose echoing back the contents of the Origin header, IF
it is whitelisted in X_DOMAINS.

For example, setting :

X_DOMAINS = 'http://localhost:9000,http://google.com'

and sending an OPTIONS request with Origin: http://mysite.com would get
Access-Control-Allow-Origin: null in return, since it was not in
the whitelist.

Sending an OPTIONS request with Origin: http://google.com would
get Access-Control-Allow-Origin: http://google.com in return,
since it was whitelisted.