Ensure that an Origin of '*' is never sent if supports_credentials is True (fixes Issue 202)
* If `always_send=True`, and `'*'` is in the allowed origins, and a request is made without an Origin header, no `Access-Control-Allow-Origins` header will now be returned. This is breaking if you depended on it, but was a bug as it goes against the spec.