Write the correct headers in response. x-full-list-fields and access-control-allow-credentials.