Do you really want to set the access control to * by default? That seems like a security risk that you are encouraging. If you just don't send the header then the browsers will force the requests to be coming from the same subdomain, which is a better default