Add 'Access-Control-Allow-Credentials' and set to 'true'.