Enable Jolokia CORS strict-checking by default

By default, we should enable Jolokia CORS strict-checking by default. Otherwise the web console is potentially vulnerable to a CSRF style attack, as Jolokia allows all origins by default.

This change has a minor backwards compatibliity implication - a REST client must specify (some) Origin header in the request - and also calling from "localhost" in the browser won't work.