Set origin for response header to '*' when it's a file:// request for now, rather than null. I assume this
is introducing some form of a vulnerability, but for testing purposes it helps a lot.