fix headers for CORS

[minrk]

• add authorization to default Access-Control-Allow-Headers
• allow overriding Access-Control-Allow-Headers just like everything else
• ensure case-insensitive comparison for proper header checks

With this fix, config to enable token-authenticated cross-origin requests on both the Hub itself and running notebooks

origin = 'http://localhost:9999'

c.Spawner.args = [f'--NotebookApp.allow_origin={origin}']
c.JupyterHub.tornado_settings = {
    'headers': {
        'Access-Control-Allow-Origin': origin,
    },
}

And an example of a page that does cross-origin access of both the notebook server and Hub, for testing.

cf #1087

[willingc]

+1

[willingc]

Looks good @minrk. Thanks for the testing gists too.