Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
Under what circumstances would a cluster administrator want to turn this flag on? Off?