Quote the asterisk in Access-Control config