API: Allow cross-origin requests

When a REST API is called from within a browser page from a different domain,
the server needs to explicitly allow this. This makes the OctoPrint
API available also to other webapps, for instance those hosted on same network in hackerspace.
API: Only allow cross-origin requests if explicitly enabled

To enable, set the key "allowCrossOrigin" under "api" in config.yml
No user interface for this option yet
API: Add documentation for newly added cross-origin config option
API: Clarify Access-Control-Request-Header handling

'headers' was a way too generic name, and the code structure implied
it was used in place of 'resp.headers' or 'request.headers', which is not the case.
Also add comment about the purpose of this code.
ACCESS_CONTROL_REQUEST_HEADERS => Access-Control-Request-Headers

While flask internally translates that just right back, this makes the implementation more readable since it matches the standard header name