Respect AllowCredentials option for OPTIONS requests