clarify wildcard subdomain

Author: cephalin

articles/app-service/app-service-web-tutorial-rest-api.md

@@ -215,7 +215,7 @@ az resource update --name web --resource-group <group-name> \
   --parent sites/<app-name> --set properties.cors.supportCredentials=true
 ```
 
-This operation is not allowed when allowed origins include the wildcard origin `'*'`. Specifying `AllowAnyOrigin` and `AllowCredentials` is an insecure configuration and can result in cross-site request forgery.
+This operation is not allowed when allowed origins include the wildcard origin `'*'`. Specifying `AllowAnyOrigin` and `AllowCredentials` is an insecure configuration and can result in cross-site request forgery. To allow credentials, try replacing the wildcard origin with [wildcard subdomains](#how-do-i-set-allowed-origins-to-a-wildcard-subdomain). 
 
 [!INCLUDE [cli-samples-clean-up](../../includes/cli-samples-clean-up.md)]