You'll need to set `xhr.withCredentials = true;` somewhere in here, but it might just be easier to use jQuery for this