app_no_client.js works withoutcredentials.js