Allow all hosts to be CORS-enabled by * as also used in the HTTP spec.