set Access-Control-Allow-Credentials to true for every request to accomodate cookies.