I would specify `window.location.origin` instead of `'*'`