[cors] missing Access-Control-Allow-Credentials header

[st-h]

When trying to access a file using a browser and a cors request that includes cookies, the request fails due to:

Credentials flag is true, but Access-Control-Allow-Credentials is not "true".

This is a browser limitation. Example of a fetch request:

fetch(url, {
    credentials: 'include',
    mode: 'cors'
})

Pull request: #416