Add header in attempt to get cross-site scripting to work.
NB: '*' is a dangerous value and **should not be used in production**.