Improved support for CORS

Added `{withCredentials: true}` at `oauth2.exchangeForToken` function, see issue #210