Add X-CSRFToken to Access-Control-Allow-Headers.

Add ```X-CSRFToken``` to ```Access-Control-Allow-Headers``` to fix ```Request header field X-CSRFToken is not allowed by Access-Control-Allow-Headers``` 

Console log:
>XMLHttpRequest cannot load http://127.0.0.1:5000/search?user=alice&usage_id=usage_id&course_id=course_id. Request header field X-CSRFToken is not allowed by Access-Control-Allow-Headers. 0.0.0.0:8000/courses/edX/DemoX/Demo_Course/courseware/e2f5c7d4472c45eb9839bbc6446121ab/ae0dd02429574cc5b8fde053c8d608df/:1
API request failed: '0' 0.0.0.0:8000/static/js/vendor/edxnotes/annotator-full.min.js:26Annotator.Plugin.Store.Store._onError 0.0.0.0:8000/static/js/vendor/edxnotes/annotator-full.min.js:26

@Treora , @nickstenning please look at this.