Fix bad default behavior with Access-Control-Allow-Credentials