human
Solve the following python programming problem given the following code:
def cors(handler, registry) : 
    log.info ('cors_tunneling enabled') 
    allow_origins_setting = registry.settings.get ('cors.allow_origins', '').strip () 
    allow_origins = [each.strip () for each in allow_origins_setting.split (',')] 
    allow_credentials = registry.settings.get ('cors.allow_credentials', None) 
    def cors(request) : 
        origin = (request.headers.get ('Origin') or request.host_url) 
        response = handler (request) 
        if ((origin in allow_origins) or ('*' in allow_origins)) : 
            response.headerlist.append (('Access-Control-Allow-Origin', origin)) 
if (allow_credentials is not None) : 
            response.headerlist.append (('Access-Control-Allow-Credentials', allow_credentials)) 
return response 
if (not allow_origins_setting) : 
        log.warning ('cors.allow_origins is not set') 
else : 
        log.info (('Allow Origins = %s ' % allow_origins)) 
if (allow_credentials is None) : 
        log.warning ('cors.allow_credentials is not set') 
else : 
        if (asbool (allow_credentials) and (<MASK> == '*')) : 
            raise Exception ('Not allowed Access-Control-Allow-Credentials to set to TRUE if origin is *') 
else : 
            log.info (('Access-Control-Allow-Credentials = %s ' % allow_credentials)) 
return cors 
    
    Given the code above, what is a proper replacement for <MASK>?
assistant
#Here is a proper replacement for <MASK>.
allow_origins_setting