What's the effect if the subsequent `this._xmlHttpRequest.withCredentials = true` is filtered out vs. it isn't'?