[security] Add Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods in CORS successfull headers