fix: do not add CORS Credentials header

[lidel]

AFAIK IPFS Desktop does not need this header.

See also:

• Potential problem with Access-Control-Allow-Credentials: [CORS] Old library makes exploitable CORS configuration (need to update dependency) kubo#5745
• HTTP Headers Cleanup: HTTP Headers Cleanup: API and Gateway in-web-browsers#132

[hacdias]

Thank you @lidel 😄 I'm merging this!