Basic CORS support

Added support and tests for CORS.  The CORS settings are cached so we don't have to parse them every time we need them.

Refactored how settings sets a select value so that it more closely matches other settings.  Added more tests for settings.

Added basic security documentation.

We could add additional CORS features, if they are ever needed: origin-specific permissions (currently all origins that are allowed permit the same headers and methods), max-age, expose-headers, and allow-credentials.
On Wed, Dec 10, 2014 at 8:51 AM, David Manthey <notifications@github.com>
wrote:

> ​I​
>  don't think CORS actually adds much security in an absolute sense, since
> if the caller spoofs or omits the Origin header, the request won't
> trigger a CORS error (and, according to the w3 spec, lack of an origin
> shouldn't trigger an error). However, it does make it so you can use a
> reputable browser to make unauthorized requests.
>
> ​I always thought the same-origin policy
 was meant to protect the *client* from malicious code on the servers it
could otherwise retrieve resources from, and thus that CORS was a way to
relax a policy meant to prevent accidental self-harm.
​  Is that not right?