added xhr withCredentials for correct cookie handling
removed localhost test url