Summary

CORS seem to fail with Client4 although mattermost-server has AllowCorsFrom set to "*"

Environment Information

• Chrome 65
• Webapp
• Mattermost Server 5.0.0

Steps to reproduce

Try to call Client4.getMe()

Expected behavior

Getting the results from the server.

Observed behavior

Chrome says: Failed to load http://localhost:8065/api/v4/users/me: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. Origin 'http://localhost:8081' is therefore not allowed access.

A simple test posted here:
mattermost/mattermost#8687
using fetch (fetch('http://localhost:8065/api/v4/system/ping')) works.