ENYO-3634 Fix Ares CORS request handling

The setCorsHeaders function has been modified so that:
# non-CORS request do not require CORS headers anymore (which saves some bandwidth as a side effect)
# CORS requests are always allowed if the "*" is listed in allowed origins from ide.json file
# CORS requests are otherwise only allowed if the Origin header (as sent by the client) is available in the list of valid origins from ide.json configuration

With this change, Ares will behave as per the W3C CORS recommendation, and the content of cors.origins array in ide.json becomes a list of valid origins (as intended).
ENYO-3634: adding localhost as a proper origin for Ares services requests

Our of the box, Ares services listen on 127.0.0.1:9009. Any request made from this address is a non CORS request. However, accessing services from localhost:9009 is considered a CORS request. Adding http://localhost:9009 as a valid origin will make sure that services are accessible from localhost interface.
Merge branch 'master' of github.com:enyojs/ares-project into ENYO-3634
ENYO-3634: addind cache directive for CORS requests

OPTIONS CORS request should be cacheable for efficiency. By adding an Access-Control-Max-Age header, we tell the browser that caching is ok (may not be implemented though). The value is expressed in second (value set: 1 day).
ENYO-3634: Ares proxy services are local, CORS should be filtered out

When services are being called through Ares, the client calls Ares first which act as a proxy to the service. If the request is a CORS request, Ares is to decide if it loet goes or not.
The service should not be exposed to whether the browser<->Ares relationship was same origin or not.
When passing on the request to the service, we remove any possible 'Origin' header of simple CORS requests. This will make any CORS request non-CORS (OPTIONS are never processed here).
When parsing the response, we remove any CORS headers that may have been set so that Ares does not get its own CORS headers to be replaced by what has been set by the service.
ENYO-3634: fix previous commit - added a chunk by mistake

this created a syntax erro in previous commit - pushed too soon. Detected by Travis.
ENYO-3634: addind Allow-control-expose-headers header in CORS request

By default, a CORS enabled browser will ignore any header not considered "simple". As per the W3C documentation:
"User agents must filter out all response headers other than those that are a simple response header or of which the field name is an ASCII case-insensitive
match for one of the values of the Access-Control-Expose-Headers headers (if any), before exposing response headers to APIs defined in CORS API specifications."
The simple headers are "Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma".
We are setting the header x-content-type in some of Ares responses. If we do not *expose* it using the Allow-Control-Expose-Headers, the browser will never get this header.
Merge pull request #736 from enyojs/ENYO-3634

ENYO-3634: Fix CORS issues with Ares
Merge remote-tracking branch 'origin/master' into ENYO-3763