Another CORS change. Treat "file://" like a valid origin if "*" is allowed.