add withCredentals options to xhr when doing cross-domain requests