Avoid wildcard Access-Control-Allow-Origin when Access-Control-Allow-Credentials is true

From [the spec](http://www.w3.org/TR/2008/WD-access-control-20080912/#access-control-allow-origin)

> For requests **without credentials**, a server can specify that a resource can be accessed
> by any origin using a wildcard: Access-Control-Allow-Origin: *

For wildcard `Access-Control-Allow-Origin` user agents will still issue requests, but the client cannot access the returned data (different user agents may behave differently here, some may refuse to make the request.  

From the [Mozilla docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Requests_with_credentials):

> **Important note**: when responding to a credentialed request,  server **must** 
> specify a domain, and cannot use wild carding.