Add CORS headers Access-Control-Allow-Credentials and Access-Control-Allow-Origin