Graphite: set Access-Control-Allow-Credentials for Grafana

..and exempt OPTIONS requests from the auth requirement, so CORS preflight
works.  Per http://grafana.org/docs/#graphite-server-config

Change-Id: I9303834fbfee8292a4343a39cee842b546e3b45b