Credentials flag error

[kumavis]

Getting error in browser:

 XMLHttpRequest cannot load http://localhost:8080/. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://requirebin.com' is therefore not allowed access.

There doesn't seem to be any credential flags, so I'm a little confused.

Remote Address:127.0.0.1:8080
Request URL:http://localhost:8080/
Request Method:POST
Status Code:500 Internal Server Error

Request Headers:
POST / HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Content-Length: 105
Pragma: no-cache
Cache-Control: no-cache
accept: */*
Origin: http://requirebin.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
content-type: text/plain;charset=UTF-8
Referer: http://requirebin.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,ja;q=0.6
Cookie: [ ... ]
DNT: 1

Request Payload:
{"jsonrpc":"2.0","method":"eth_balanceAt","params":["0x407d73d8a49eeb85d32cf465507dd71d507100c1"],"id":1}

Response Headers:
HTTP/1.1 500 Internal Server Error
X-Powered-By: Express
Access-Control-Allow-Origin: *
Vary: Origin
Content-Type: application/json; charset=utf-8
Content-Length: 37
Date: Mon, 19 Jan 2015 01:06:19 GMT
Connection: keep-alive

[kumavis]

Some sneaky code was setting xhr.withCredentials = true. grrrr.