Fix typo in CORS header name (Access-Control-Allow-Credentials)
Add tests for redirects and CORS headers