Allow fetch X-CSRF-Token and setCookie after login/register