swagger: allow cross-origin requests

Add CORS middleware to the swagger app.

Add a configuration option allowing developers to disable CORS.

See also https://github.com/strongloop/strong-studio/issues/390

/to @raymondfeng please review
/cc @seanbrookes 
@raymondfeng I am not entirely sure about this line. Should it be `{ origin: corsOpts, credentials: corsOpts}` instead; i.e. `{ origin: false, credentials: false}` when cors is disabled?