use window.document.cookie for XHR