added xhr withCredentials for correct cookie handling