update cors to allow credentials and origins list