allow for * in CORS settings if it's explicitly specified