Compatible with HTTP basic auth.

If you want to use HTTP basic auth via CORS, you can't have the wildcard for "access-control-allow-origin" and you must set "access-control-allow-credentials" to "true".