If you need it - cors without .htaccess (now with allowed wildcard, without HTTP_ORIGIN)