XhrRequest: withCredentials = false