Access-Control-Allow-Origin: <origin>

Only a single origin can be specified. If the server supports clients from multiple origins, it must return the origin for the specific client making the request.