add AllowCredentials header on OPTIONS request