Don't pass along credential info

[mattfullerton]

This causes problems with sites that have wildcard CORS set up: "The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'."

So I was just wondering if there was an overt reason for setting this up this way, or if we can change it, with this provocative commit/PR :-)