typo
xhr.credentials flags