Fine tune CORS policies depending on the READ/WRITE actions

See https://github.com/c2corg/v6_api/pull/48#issuecomment-150605457 from @gberaudo

> We discussed with @asaunier and it appears we should have two policies:
> - one for public data, restricted to GET method and allowed for *;
> - the other for the rest (restricted data), only allowed for c2corg and requiring credentials (JWT).

"cors_policy" in https://github.com/c2corg/v6_api/blob/master/c2corg_api/views/__init__.py#L15 should be renamed to "cors_public_policy" and, according to @gberaudo

> The policy should be passed to each view (GET and PUT should be handled differently).
> We could use annotations like: @public_json_view and @restricted_json_view instead of @json_view.