Allow credentials to be sent on COR