FIX: pass in username/password into xhr if credentials are available