using withCredentials as an option instead of header