Moved the credentials header to be sent when it's an OPTIONS or GET, etc...