make CORS configurable

allows setting CORS headers.

- cors_origin sets Access-Control-Allow-Origin directly
- cors_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support complex access[1]
- cors_credentials sets Access-Control-Allow-Credentials: true

To allow CORS from everywhere:

    ipython notebook —NotebookApp.cors_origin='*'

ping @rgbkrk who did the original CORS check
Also, one other difference here. [tornado will let an unset `origin` pass through as well](https://github.com/tornadoweb/tornado/blob/3824b4c80bf148635de24cfb8da81f3960d5cd18/tornado/websocket.py#L150). That's useful for the emacs websockets case that some users brought up (and I would want for Atom). It's the browser that provides this header, so I think this is fine.