Added a flag to allow sending the wildcard in a Access Control Allow Origin Response

We have clients that make unauthenticated GET requests, and do not send an HTTP_ORIGIN header, so the CORS headers will never be sent for them. I added a flag to send the CORS headers even if there is no HTTP_ORIGIN specified and the default Access-Control-Allow-Origin value is '*'