CORS and PHP Sessions working now

thanks to
header('Access-Control-Allow-Credentials: true');