Allowing star as cors header.