setWithCredentials true - very useful for cross-domain requests