set withCredentials to true for cookie based CORS
0.4.0
0.5.0