add CORS_ALLOW_CREDENTIALS = True to settings, to allow credentialed (cookies) requests
Merge branch 'master' of github.com:ddsc/ddsc-api