include allow-credentials in simple requests