Proposal for Support CORS (Cross-Origin Resource Sharing) #216

Add a Filter to handle multiple resources and a Helper to add CORS headers manually.
To be W3C compliant, the logic in this method needs to distinguish between pre-flight OPTIONS requests and normal requests. 

For pre-flight OPTIONS requests, you need to:
- check whether the request origin is allowed; if not, do not add any CORS headers in the response
- check that a method was requested and that the requested method is allowed; if not, do not add any CORS headers to the response
- check that ALL of the requested headers are allowed; if not, do not add any CORS headers to the response.
- check whether the resource supports credentials.  If so, add an Access-Control-Allow-Origin header for the origin,and a Access-Control-Allow-Credentials header with the value "true".  Otherwise, add an Access-Control-Allow-Origin header, with either the value of the Origin header (if not all origins are allowed) or the string "*" (if all origins are allowed).
- if the resource has a configured maximum caching age configured, add a Access-Control-Max-Age header with the value of the number of seconds the user agent is allowed to cache the result of the request.
- add the Access-Control-Allow-Methods header and the Access-Control-Allow-Headers headers.

For normal requests, you need to:
- check whether the request origin is allowed; if not, do not add any CORS headers in the response
- check whether the resource supports credentials.  If so, add an Access-Control-Allow-Origin header for the origin, and a Access-Control-Allow-Credentials header with the value "true".  Otherwise, add an Access-Control-Allow-Origin header, with either the value of the Origin header (if not all origins are allowed) or the string "*" (if all origins are allowed).
- add an Access-Control-Expose-Headers header for any headers which the resource should expose
- note: for normal requests, the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers are not returned in the response; those are only for pre-flight OPTIONS requests.

See http://www.w3.org/TR/cors sections 6.1 and 6.2 for details.  Also, if interested, see https://github.com/adennie/vroom/blob/master/vroom-core/src/main/java/com/fizzbuzz/vroom/core/api/filter/CorsFilter.java for some implementation logic which you are free to copy if you like.