our Allow-Origin header is never "*" so remove that guard

I was refering to this note:

"The string "*" cannot be used for a resource that supports credentials."