add withCredentials to options