make CORS configurable

allows setting CORS headers.

- allow_origin sets Access-Control-Allow-Origin directly
- allow_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support nontrivial rules.
- allow_credentials sets Access-Control-Allow-Credentials: true

To enable CORS from a particular domain:

    ipython notebook —NotebookApp.allow_origin='https://mydomain.com'

ping @rgbkrk who did the original CORS check and PR against Tornado.