Bugfix/cors

The was two mistakes in Access-Control-Allow-Methods :
* ` s` was missing
* list of allowed methods is now sent (as expected) and not only the requested method

The default value for Access-Control-Allow-Credentials has been changed from `true` to `null`