added quotes around asterisk in Access-Control-Allow-Origin