cors: Set Access-Control-Allow-Credentials to true (#4185)

This allow browsers to send credentials with preflighted requests.

cmd/generic-handlers.go

@@ -278,6 +278,7 @@ func setCorsHandler(h http.Handler) http.Handler {
 		AllowedMethods:   defaultAllowableHTTPMethods,
 		AllowedHeaders:   []string{"*"},
 		ExposedHeaders:   []string{"ETag"},
+		AllowCredentials: true,
 	})
 	return c.Handler(h)
 }