use 'withCredentials' option in CORS requests