CORS now allows credentials, bug fixed