Flip credentials to be a non-negative parameter. Fix a bug with CORS preflights (did not specify credentials usage).