explicitely set allow credentials header to false