CORS filter configuration enhancements

[hhund]

As of 3e8e26b the 'Access-Control-Allow-Origin' header value is configurable.

Short-term pleas evaluate if the current hard-coded values for 'Access-Control-Allow-Headers' are correct/necessary, 'Access-Control-Allow-Credentials' = true is needed and 'Access-Control-Allow-Methods' isn't missing a HEAD entry.

Long-term we might want to make the values of 'Access-Control-Allow-Credentials', 'Access-Control-Allow-Headers' and 'Access-Control-Allow-Methods' configurable as well.