Added allow credentials in CORS