"Access-Control-Allow-Credentials" header for all request types

Issue davidtinker/grails-cors#3 
* Added "Access-Control-Allow-Credentials" for all request types
* Added unit test for setting default headers