Fix proper usage of the Allow-Origin header. Also send the
Allow-Credentials header and allow any requested headers.