added credentials to $.ajax call