Fix CORS response headers.

The combination of `Access-Control-Allow-Credentials: true` and
`Access-Control-Allow-Origin: *` is illegal for CORS specifications:
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

packages/core/strapi/lib/middlewares/cors.js

@@ -40,7 +40,7 @@ module.exports = config => {
 
       const requestOrigin = ctx.accept.headers.origin;
       if (whitelist.includes('*')) {
-        return '*';
+        return credentials ? requestOrigin : '*';
       }
 
       if (!whitelist.includes(requestOrigin)) {