Fix CORS headers so that they actually work.

Access-Control-Allow-Credentials should be "true" instead of "*", and a non-* origin must be specified via Access-Control-Allow-Origin in order for credentials to work.