adds allowOrigins setting
parse wildcards