Emit Access-Control-* headers for a simple or preflight response. * plus credentials is invalid. Prefer an explicit origin in production.