Fix CORS to allow credentials