It seems like the error indicate that the received value for the request /forest/session is the wildcard value for Access-Control-Allow-Origin. This stack overflow seems to cover this topic.
I would suggest not to use the * value, even in dev.
If I understood the error correctly, your value overrides the one in forest_liana, that’s why the call seems to fail.