withCredentials defaults to false