Fix CORS implementation with credentials.

It's not possible to return a wildcard when using credentials, so it's needed
to return the actual origin that's being authorized.

@natim r?