Added CORS support for web API

[chqr1y]

#94

Added CORS support for web API :

• the default policy is '*' for '/api/*'
• an optional argument '--origin' is added to restrict the CORS to one origin

[lanmaster53]

Did you thoroughly test this? It looks like it should work since there is no authentication. In fact, we don't even need to include the ability to specify an origin yet. It isn't needed unless there is authentication, which requires the ACAC header. Everything should work with the wildcard ACAO header.

[chqr1y]

Yes, I'm confident in my tests.

I agree with your comment, this behavior is little silly.
In the real world, no one's going to 'origin' argument to reactivate the CORS policy.

I think we should choose between these two behaviors:

• We use the wildcard ACAO header all the time (For an application that runs on localhost, that sounds okay)
• We set the default policy to deny and the end user will have to whitelist his application with the argument '--origin'.

What do you prefer?

[lanmaster53]

For now just wildcard the ACAO header.

[lanmaster53]

Also, please change the target branch to staging, not master. Thanks!