Add test for wildcard CORS domain; decouple CORS implementation choices from tests