allowing wildcard CORS, probably a bad idea