Do we have access to the request object here? And in particular to the `Origin` header?

Because the RFC doesn't allow a wildcard for a credentialed request (cf. ["Important note: when responding to a credentialed request,  server must specify a domain, and cannot use wild carding."](https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Requests_with_credentials). I'd link to the RFC but the MDN page is clearer about that IMO.), and since it can't hurt for regular requests, you might want to change it to something like `response.headers['Access-Control-Allow-Origin'] = request.headers['Origin'] || '*'`.