add protocol to allowed CORS origin
CORS credentials are allowed