Basic CORS support

Added support and tests for CORS.  The CORS settings are cached so we don't have to parse them every time we need them.

Refactored how settings sets a select value so that it more closely matches other settings.  Added more tests for settings.

Added basic security documentation.

We could add additional CORS features, if they are ever needed: origin-specific permissions (currently all origins that are allowed permit the same headers and methods), max-age, expose-headers, and allow-credentials.
Is this the right behavior? Does this always just set the Access-Control-Allow-Origin to whoever is making the request? Wouldn't that universally permit CORS? I am certain I'm missing something :)