CORS: Allowed to configure allow-credentials header to work via SSL

This adds support to return the "Access-Control-Allow-Credentials" header
if needed, so CORS will work flawlessly with authenticated applications.

Closes #6380
can we use a constant here?