make CORS configurable

allows setting CORS headers.

- cors_origin sets Access-Control-Allow-Origin directly
- cors_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support complex access[1]
- cors_credentials sets Access-Control-Allow-Credentials: true

To allow CORS from everywhere:

    ipython notebook —NotebookApp.cors_origin='*'

ping @rgbkrk who did the original CORS check
Technically, I would put that this "takes precedence over `cors_origin_pat`", as that's what the current implementation does (no enforcement of mutual exclusivity).