fix Access-Control-Allow-Credentials defaults in README and add changelog