Set withCredentials:true on XmlHttpRequest to allow authenticated cross-domain requests

withCredentials:true is required for cross-domain authenticated requests.

On the server-side we need a reverse-proxy that should set the appropriate CORS headers:

Access-Control-Allow-Origin "<list of comma separated urls from which requests are allow e.g. http://demo.org/>"
Access-Control-Allow-Headers "accept, origin, sd-connection-string"
Access-Control-Allow-Methods "GET"
Access-Control-Allow-Credentials "true"

Unfortunately, if withCredentials is true, Access-Control-Allow-Origin CANNOT BE set to the wildcard (*) domain.

Here is a trick you can employ to emulate it:
<Virtualhost *:80>
...
SetEnvIf Origin (.*) allow-origin-host=$1
Header set Access-Control-Allow-Origin "%{allow-origin-host}e"
...
</Virtualhost>