Fixed wildcard * test for CORS allowed origins