Add conditional check when cors.allowOrigin is *

When `cors.allowOrigin` is set to `*` (any) it currently defaults to `null` -- this fixes that.