added --cors option to webapp to enable Cross-Origin Resource Sharing

Makes it possible to use JavaScript to access ports when the html page is
not provided by rock-webapp (e.g. by file://)

Also tried environment variable instad of global, but thought it whould be better to hav a single way to enable it
I would move it inside the if cors_hosts block