Add 'Access-Control-Allow-Credentials' into response to OPTIONS request.