unofficial cookieHeader option for XHR