swagger: allow cross-origin requests

Add CORS middleware to the swagger app.

Add a configuration option allowing developers to disable CORS.

See also https://github.com/strongloop/strong-studio/issues/390

/to @raymondfeng please review
/cc @seanbrookes 
> To be consistent with strong-remoting (https://github.com/strongloop/strong-remoting/blob/master/lib/rest-adapter.js#L216), ...

I want to keep the API easy to use. Your suggestion will require developers to understand CORS option object and remember the correct option. Also the actual code does not reveal the intent of disabling CORS altogether:

```
explorer({ cors: { origin: false } })
```

How about supporting both `boolean` and `object` types of the `cors` property?

```js
var corsOpts = typeof opts.cors === 'boolean'? { origin: opts.cors } : opts.cors;
swaggerApp.use(cors(corsOpts));
```