headerAllowCredentials on preflight as well
use pre-flight headers for real
do core only if `origin` header is present
call `res.WriteHeader` after setting the headers