Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
I'm not sure that the point of CORS is to protect older browsers that somehow manage to make a cross domain request - that's CSRF protection which should be covered by requiring Bearer auth (instead of basic or cookie auth).  Enforcing the extra protection doesn't seem dangerous, but it does introduce an extra level of hard to debug failure (set Origin header from a browser that doesn't support CORS?).  Cribbing from w3:

http://www.w3.org/wiki/CORS

doesn't seem like they mandate server enforcement - the server is free to do that.  Is it valuable here?