Changes to enable js-rest-client with CORS

Ignoring 404 error in SessionAuthAgent.js is for:
When browser restarts and session cookie is deleted, deleteSession sends session id from localStorage and gets a 404 in response. Login then does not send POST to user/sessions for a new session. I'm not sure about this solution, but works for me for now. Still leaves issue with 401 response, when logged in from another client (like Platform UI). But in that case deleting cookie/restarting browser will work.

Setting XHR.withCredentials = true; is needed so browser will accept cookie from cross domain request.