Access-Control-Allow-Origin' header is missing on mybinder.org

We tried it yesterday for CORS issue on GESIS, but it didn’t work (
https://github.com/jupyterhub/mybinder.org-deploy/issues/1344#issuecomment-587424984):

okay, that’s back to denied by Cross-Origin Resource Sharing policy: Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.