title: Django CORS headers whitelist doesn't work
body: <p>I'm working on an existing code base which consists of a Django backend and a ReactJS frontend.
  Everything is dockerized so I'm running the backend on <code>localhost:8001</code> and the frontend on <code>localhost:3000</code>. </p>
  
  <p>Because I got CORS errors in the browser, I added <a href="https://github.com/adamchainz/django-cors-headers" rel="nofollow noreferrer">django-cors-headers</a> to Django. When I add <code>CORS_ORIGIN_ALLOW_ALL = True</code> however, I get an error saying</p>
  
  <blockquote>
    <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at ‘<a href="http://127.0.0.1:8001/devices/" rel="nofollow noreferrer">http://127.0.0.1:8001/devices/</a>’. (Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’).</p>
  </blockquote>
  
  <p>So then I added the following settings:</p>
  
  <pre><code>CORS_ORIGIN_ALLOW_ALL = False
  CORS_ORIGIN_WHITELIST = (
      'http//:127.0.0.1:3000',
      'http//:127.0.0.1:8001',
  )
  </code></pre>
  
  <p>But than I get an error saying</p>
  
  <blockquote>
    <p>CORS header ‘Access-Control-Allow-Origin’ missing</p>
  </blockquote>
  
  <p>Why is the whitelist not working? Am I doing something wrong here?</p>