Fix allowCredentials bug

This bug set the `Access-Control-Allow-Credentials` header if
`cors.allowCredentials` was anything other than `null`.  Since the
default value of this header is `false`, it was being set by default.