fix wildcard CORS (*)