Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
I agree that there is no mandate for server enforcement ("Based on the value of the Origin header in cross-origin requests it can decide to return no data at all...") and that we are already relying on the client for enforcement. I guess it just makes me a bit uncomfortable to relinquish complete control to the client (you still leak data because the network traffic is visible on the client machine even if the web browser decides to hide it from the user).