Changed CORS filter to always set certain headers . Changed angular $http. to always add withCredentials flag to XHR in order to allow cookie transmission required for session detection