Updates to CORS section requested by DRG. Basically just adding back
in the object-level access control header info that was removed in
Sept. 2013. Also added a note to Create a static website section to
describe how to disable a static website, also requested by DRG.