Handle wildcard in access-control-allow-origin