ENYO-3771: allow cookies to be set on CORS request from allowed origins

By default, CORS requests are not allowed to set cookies back. This is needed for Ares during Phonegap authentication process. We can have it "always on" as we are controlling anyway the list of origins. A trusted origin should have "full capabilities", including Phonegap build.
ENYO-3771: all phonegap API calls should contain the authentication token

The PGB token is stored as a cookie. When PGB service is used under CORS conditions (e.g. Ares is run on localhost:9009), cookie are by default *not sent* to server. The PGB service does not therefore receive the authentication token and operation fails.
We need to enable the xhr option "withCredentials". This allow cookies to be sent, which repair the faulty behavior.
Merge pull request #746 from enyojs/ENYO-3771

ENYO-3771: fix phonegap build on Ares CORS access use cases