add AllowCredentials header on OPTIONS request

cross-domain requests with enabled credentials require credentials header on OPTIONS request.