AllowOrigins allows for bypass

Currently when matching the origin header of a request to AllowOrigins there is no verification of the start and end of the regex. Someone could abuse this. Consider the following example.

```
m.Use(Allow(&Options{
    AllowOrigins: []string{"https://www.foo.com"},
}))
```

The intention was to only allow from www.foo.com. However, the owner of bar.com could create a record for "www.foo.com.bar.com", allowing for bypass of the restriction. To resolve this I borrowed a solution from the Hapi.js framework. That is first escape the regex, replace needed characters to allow for wildcards, and then adding "^" and "$" to the regex.