Add Access-Control-Allow-Credentials to All

If you do a "simple" request, there will be no CORS preflight
OPTIONS request.  That means that Basic auth will fail over
CORS.  This adds the header to all requests, fixing the problem.

Closes #122