Add conditional check when cors.allowOrigin is *

When `cors.allowOrigin` is set to `*` (any) it currently defaults to `null` -- this fixes that.
I don't think triggering an error is necessary.  I was thinking more like allowing both `null` and `*` to be valid values that both result in the default functionality.