Add Access-Control-Allow-Credentials to the CORS headers.
Merge pull request #2604 from vikhyat/fix-cors

Add Access-Control-Allow-Credentials