Add "withCredential" to AJAX request