Allow for wildcard value for `allowed_origins/2` callback

The callback can now return the atom '*' in order to indicate that any
origin is acceptable.  This provides a simple mechanism for allowing
CORS requests from any Origin.

Due to the requirement that "*" cannot be returned when credentials
are allowed, we simply only ever set Access-Control-Allowed-Origins to
be the Origin of the client.  Unless there are any surprises with
client implementations, this should sufficiently cover the necessary
use cases.