Send Access-Control-Allow-Credentials in response to simple requests as well

Should fix issue 2 and allow the example scenario as posted by Mozilla on https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS?redirectlocale=en-US&redirectslug=HTTP_access_control#Requests_with_credentials