Change behaviour of CORS_ORIGIN_ALLOW_ALL

If setting:

    CORS_ORIGIN_ALLOW_ALL = True

response should limit the allowed origins to that request's origin, which would be much safer than using '*'' while still allowing all origins.

To keep compatibility with the old mode, using '*' for the setting will set allowed origins header to '*'.

    CORS_ORIGIN_ALLOW_ALL = '*'