Add support for Access-Control-Allow-Credentials header

The browser security model prevents the `Cookie` header from being sent in cross-origin requests (despite including "Cookie" in `Access-Control-Allow-Headers`) unless the `Access-Control-Allow-Credentials` header is set to "true". 

This patch allows the `Access-Control-Allow-Credentials` header to be set by passing `with_credentials=True`.

While this can be done by returning the appropriate response headers, it may be a common enough desire to justify adding a convenient method of supporting it.