An investigation into CORS and `XMLHttpRequest.withCredentials`