Added "Access-Control-Allow-Credentials" to x-domain /csrfToken response