true sends Access-Control-Allow-Credentials: true. Browsers do not accept it with origin *, so list your sites in origin then. Dox prints a warning at start for that mix.
true
Access-Control-Allow-Credentials: true
*
final bool? credentials;