Return origin by default instead of wildcard
http://www.w3.org/TR/cors/#supports-credentials
The string "*" cannot be used for a resource that supports credentials.
0.0.11