added possibility to use xhr object with credentials