Adds Access-Control-Allow-Credentials: true for coping with HTTPS

[karlcow]

@miketaylr and @magsout found out in https://github.com/webcompat/webcompat-metrics-server/issues/26#issuecomment-398522341 that we had a Access-Control-Allow-Credentials error.

After reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials it is mandatory for HTTPS.

Credentials are cookies, authorization headers or TLS client certificates.

and

The Access-Control-Allow-Credentials header works in conjunction with the XMLHttpRequest.withCredentials property or with the credentials option in the Request() constructor of the Fetch API. Credentials must be set on both sides (the Access-Control-Allow-Credentials header and in the XHR or Fetch request) in order for the CORS request with credentials to succeed.

Access-Control-Allow-Credentials: true

[karlcow]

Success!