Specify Access-Control-Allow-Credentials to allow authenticated request