2.1.3 Bump
Set Access-Control-Allow-Credentials for all responses

In order to inform the browser to set the Cookie header on requests, this
header must be set otherwise the session is reset on every request.
2.1.3 Release