Accept cookies when using CORS

Setting XHR.withCredentials = true; is needed so browser will accept cookie from cross domain request.