configure cors credentials + whitelist
0.3.0