Use Origin instead of * when allow all and allow credentials are both set

When CORS_ALLOW_ORIGIN_ALL and CORS_ALLOW_CREDENTIALS are both true this change return the Origin and not *.
This fixes error(1) throw by browsers because * is not a valid origin when credentials are enabled.

(1) XMLHttpRequest cannot load https://app.xxxxx.com/api/xxx/. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://xxxxx.com' is therefore not allowed access.