けんき says to YSITD A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true.