we should probably make this optional, otherwise you get "Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true"