What are the security implications of adding all domains to CORS headers? (stackoverflow.com)