Send credentials w/ all ajax requests; fix server to accept credentials (cookies)

EOM.