As @KazW pointed out, we should use more secure way of setting Access-Control-Allow-Origin header