Explained credentials vs wildcard origin, closes #35