make CORS configurable

allows setting CORS headers.

- cors_origin sets Access-Control-Allow-Origin directly
- cors_origin_pat allows setting Access-Control-Allow-Origin via regular expression, since the header spec itself doesn’t support complex access[1]
- cors_credentials sets Access-Control-Allow-Credentials: true

To allow CORS from everywhere:

    ipython notebook —NotebookApp.cors_origin='*'

ping @rgbkrk who did the original CORS check
Just a note that tornado ended up going with a 403 instead of a 404 here, so this will differ between an IPython notebook server that has `tornado >= 4` and `tornado < 4`