Would there be support for configuring the Access-Control-Allow-Credentials header dynamically? It looks like currently the only valid values for the credentials config option is true. Allowing a function similar to the origin option would allow for setting Access-Control-Allow-Credentials based on the request.