Allow Cross-Origin requests for frontend agents

[hmdhk]

apm-server should respond to OPTIONS and POST requests with correct access control headers:

Response to OPTIONS should include these
Access-Control-Allow-Origin "*";
Access-Control-Allow-Headers "Content-Type";
Access-Control-Allow-Methods "POST";

Note: We have to update Access-Control-Allow-Headers if we choose to use custom headers on the agent side but for now the above should be enough.

And the response to the original POST request should include:
Access-Control-Allow-Origin "*";

In production mode Access-Control-Allow-Origin should be configured by the user to something other than "*"

Docs:
https://fetch.spec.whatwg.org/
https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

[roncohen]

Closed by #244