Move CORS handler wrapping into cmd/apiserver and switch config flag to a list of allowed origins