add Control-Allow-Credentials option. Origin option is string not an array