add credentials headers on OPTIONS request