Send Access-Control-Allow-Credentials in response to simple requests as well.