Add `crossOrigin: true` for Reqwest to work with CORS

It only sets the `X-Requested-With` header AFAICS.