omit withCredentials: true on non-API ajax