Allow CORS globbing

Allow CORS to be a glob, allowing all hosts.