bug: dev-env CORS headers fixes

[davidcheung]

if we use the manual snippet we cannot use the enable-CORS annotation, it will both append an origin header making the request always fail.

also we need to add a allow-credentials: true