Update to support CORS Allow-Credentials

Send CORS Allow-Credentials header; 
Echo Allow-Origin (cannot use * with allow credentials)
Allow CORS pre-flight OPTIONS request to bypass authorization checks.