Add withCredentials to all requests