Prevent wildcard `expose_headers` value when `allow_credentials` is `true`

[Blacksmoke16]

The spec doesn't allow the * wildcard when credentials are allowed, so let's just prevent it.