Add option to enable a simple CORS implementation for the api server

Related to https://github.com/GoogleCloudPlatform/kubernetes/issues/1128
Hm? It's expected != actual everywhere in k8s. Am I doing it wrong?