Cross-origin protection (#375)

* Initial implementation

* Comments

* Send a 403 on denied origin

* Noodling around with `set_allowed_origins`

* Error on empty list

* Soketto 0.6

* fmt

* Add `Builder::allow_all_origins`, clarify doc comments

* Rename Cors -> AllowedOrigins, nits, no panic