Add Access-Control-Allow-Credentials

This was being added earlier but it was removed in this commit:

https://github.com/discourse/discourse/commit/46c406360d7ac851a3f4977f89178c5480cc063b