Correct management of wildcard, fix #6

The fix to #3 used the raw Destination value for identifying a target
field, but no field is named "*"
Added VSO support

Explicit check for a VSO URL, in which case VSO alternate credentials
are required.
Documented VSO support