refactor CORS filter to use a config object

https://github.com/playframework/playframework/pull/3371#issuecomment-54926355