feat($cookies): allow cookies to be sent w/ CORS submits
closes #7