Document wildcard in allowed_origins