make CORS configurable

allows setting CORS headers.

- cors_origin sets Access-Control-Allow-Origin directly
- cors_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support complex access[1]
- cors_credentials sets Access-Control-Allow-Credentials: true

To allow CORS from everywhere:

    ipython notebook —NotebookApp.cors_origin='*'

ping @rgbkrk who did the original CORS check
Not sure if my comment belongs here or elsewhere, but it would be nice to have documentation here that this is explicitly overriding check_origin for `tornado >= 4` but that it gets handled for lesser versions.