allow credentials in GET requests
    
I think you might have thought that the only 
thing you'd have to set in a non-OPTIONS 
request was Access-Control-Allow-Origin,
but if you are trying to pass cookies, you also 
need to allow Access-Control-Allow-Credentials.

see: https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Access-Control-Allow-Credentials