I am trying to set a tunnel for my kratos project following this instructions. My application is running on port 8081 and I am running the following command:

ory tunnel <http://127.0.0.1:8081> --port 4001 --project <PROJECT_SLUG> --allowed-cors-origins <http://127.0.0.1:8081> --cookie-domain 127.0.0.1:8081 --dev --debug

But the CORS headers are not included in the response headers for the preflight requests:

HTTP/1.1 204 No Content
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Date: Sun, 03 Dec 2023 20:02:53 GMT

Request headers:

OPTIONS /self-service/login/browser HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Access-Control-Request-Headers: access-control-allow-credentials
Access-Control-Request-Method: GET
Cache-Control: no-cache
Connection: keep-alive
Host: 127.0.0.1:4001
Origin: <http://localhost:8081>
Pragma: no-cache
Referer: <http://localhost:8081/>
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36

In the terminal I get the following message:

[cors] 2023/12/03 14:25:29 Handler: Preflight request
[cors] 2023/12/03 14:25:29   Preflight aborted: headers '[Access-Control-Allow-Credentials]' not allowed

I am not sure if this could be a bug or if I am missing extra configuration. For context I am using the rust client and I am adding the headers directly to the reqwst client:

let mut headers = HeaderMap::new();
headers.insert(ACCEPT, HeaderValue::from_static("application/json"));
headers.insert(ACCESS_CONTROL_ALLOW_CREDENTIALS, HeaderValue::from_static("true"));
headers.insert(ORIGIN, HeaderValue::from_static("<http://127.0.0.1:8081>"));
let client = reqwest::Client::builder().default_headers(headers).build().unwrap();
let config = Configuration {
    base_path: ORY_ADMIN_URL.to_string(),
    user_agent: None,
    client,
    basic_auth: None,
    oauth_access_token: None,
    bearer_access_token: None,
    api_key: None,
};