Formatting
Wildcard allow-origin is incompatible with allow-credentials