CORS allow-credentials

Closes #370