First pass at implementing cors

[czcollier]

fixes #1110

[wwwillchen]

Hey - thanks for opening this PR. I left a comment on the issue: #1110 (comment)

I don't think I fully understand the requested use case, but it's not clear to me how setting Access-Control-Allow-Origin on
index.html (which is effectively what this PR is doing) would address your use case. It seems pretty unusual to want to do a cross-origin XHR/fetch for the index.html, particularly for a Mesop app.

[wwwillchen]

Instead of a separate parameter in PageConfig, I would put CORS into SecurityPolicy (i.e. allowed_cors_origins) since CORS is security-related