swagger: allow cross-origin requests

Add CORS middleware to the swagger app.

Add a configuration option allowing developers to disable CORS.

See also https://github.com/strongloop/strong-studio/issues/390

/to @raymondfeng please review
/cc @seanbrookes 
To be consistent with strong-remoting (https://github.com/strongloop/strong-remoting/blob/master/lib/rest-adapter.js#L216), we should set up CORS as follows:

```js
var corsOptions = options.cors || {origin: true, credentials: true};
swaggerApp.use(cors(corsOptions));
```

Ideally, we should also change the template for server/boot/explorer.js to pass in the cors option based on config.json settings.