Change allow-origin from * to Origin header of the request.

When using withCredentials, wildcard (*) will not work.