Enable Access-Control-Allow-Credentials in dev mode

Using dev mode overwrites ::bootstrap/allowed-origins settings, canceling the original setting.