Make CORS work when using credentials.

CORS requests containing credentials (cookie, authorization header) require the credentials flag to be set to true.