A convenience function to set CORS header

It's easy to set `Access-Control-Allow-Origin` to a single value, but it doesn't currently allow any pattern matching. This convenience function matches the request's `Origin` header against a regex, and if there is a match, sends the request's `Origin` back in the `Access-Control-Allow-Origin` response header.