Send Authorize header if permitted and existing

[procrastinatio]

If server hosting the distant resource (WMTS, WMS, KML) authorize Authorization, it should be sent, if existing:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Authorization, Origin

This should allow access on `BasicAuth protected resourses, provied the user has logged in.

As described in #2414 (Auth)