Restrict Allow-Origin so that send-creds works in devel