Make sure that requests can use credentials with X_DOMAINS=*