Access-Control-Allow-Methods: * is non-cors compliant

[bulk88]

https://github.com/balvin-perrie/Access-Control-Allow-Origin---Unblock/blob/5bc0f77f88e3dce37c2b5a1d588bbec2b94a2f48/v3/worker.js#L50

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods string "*" can't be used in a response if web code uses XMLHttpRequest.withCredentials.

            'value': prefs.methods.length === self.DEFAULT_METHODS.length ? '*' : prefs.methods.join(', ')

should be changed to

            'value': prefs.methods.join(', ')

or somehow interlocked with "Access-Control-Allow-Credentials: true" rule