[fix] Send the `Allow-Access-Control-Origin` header by default

The only major problem i'm seeing here is the allow-access-control-credientials` part. We cannot send it if we don't have origin even if people has said it should be added.