always send back * for cors allow-origin, to sidestep caching issues