CORS should not allow wildcard and a specific method

[howardjohn]

Per https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods, there are two valid options:

Access-Control-Allow-Methods: <method>, <method>, …
Access-Control-Allow-Methods: *

This implies you cannot have Access-Control-Allow-Methods: GET,*. You probably shouldn't anyways.

It probably makes sense to allow a single entry only if one is a wildcard.

Note the link is not an RFC, but the RFCs seem super vague here

[robscott]

/kind bug

[EyalPazz]

/assign