Add CORS support (defaulting to true)

Serve Access-Control-Allow-Origin: * headers on /sso_login and
/sso_logout endpoints, to allow sso auto-renewal on AJAX requests.