Fix CORS configuration — never combine wildcard origin with credentials

CORS (Cross-Origin Resource Sharing) misconfiguration, specifically combining a wildcard origin setting with credential support, creates a genuine, serious security vulnerability that undermines the fundamental security boundary CORS is meant to provide between different websites' ability to interact with each other's resources.

The specific dangerous combination this check addresses — allowing requests from any origin while simultaneously permitting credentialed requests — effectively means any website on the internet could potentially make authenticated requests to your API or resources using a visitor's existing session credentials, precisely the cross-site request scenario CORS exists to prevent.

This represents a genuinely severe misconfiguration specifically because it's sometimes introduced through a well-intentioned but mistaken attempt to simplify CORS configuration — using a wildcard origin setting can seem like a convenient way to avoid maintaining an explicit allowlist, without fully understanding the serious security implications when combined with credential support.

Correct configuration requires genuine, explicit specification of exactly which origins are legitimately authorized to make credentialed requests to your resources, rather than the wildcard shortcut — this represents more configuration effort than the wildcard approach, but is the only configuration that maintains CORS's actual intended security boundary while still supporting legitimate cross-origin credentialed access where genuinely needed.