Include status and session on XHR cors login requests