Set wildcard in Access-Control-Allow-Origin response