Basic CORS support

Added support and tests for CORS.  The CORS settings are cached so we don't have to parse them every time we need them.

Refactored how settings sets a select value so that it more closely matches other settings.  Added more tests for settings.

Added basic security documentation.

We could add additional CORS features, if they are ever needed: origin-specific permissions (currently all origins that are allowed permit the same headers and methods), max-age, expose-headers, and allow-credentials.
Are we just assuming that all browsers always use OPTIONS first to test the CORS settings?