restore lost CORS wildcard