Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
`access-control-allow-headers` are for custom headers, `Accept`, `Content-Type` and such are already allowed. Only `Authorization` and `X-CSRF-Token` would have to be specified in this case.