added --cors option to webapp to enable Cross-Origin Resource Sharing

Makes it possible to use JavaScript to access ports when the html page is
not provided by rock-webapp (e.g. by file://)

Also tried environment variable instad of global, but thought it whould be better to hav a single way to enable it
cors_hosts is an array now, so that is always true. Use #empty?