CORS now allows credentials