add option to set Timing-Allow-Origin header

[nojvek]

See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin

and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server-Timing#performanceservertiming_interface

Without the header, browser client can't access serverTiming information from cross origin request.

[yosuke-furukawa]

Ok, I will try to add this feature.