Fix Auth Headers (#1324)

Co-authored-by: Ben Toogood <ben@micro.mu>

api/server/cors/cors.go

@@ -38,6 +38,7 @@ func SetHeaders(w http.ResponseWriter, r *http.Request) {
 		set(w, "Access-Control-Allow-Origin", "*")
 	}
 
+	set(w, "Access-Control-Allow-Credentials", "true")
 	set(w, "Access-Control-Allow-Methods", "POST, PATCH, GET, OPTIONS, PUT, DELETE")
 	set(w, "Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")
 }