AUTOMATED CORS origins and preflight behavior are safe

MB-C14 ASVS Web, Transport & Cryptography Verification High

CORS does not combine wildcard origins with credentials and preflight behavior is constrained.