We need to set withCredentials to false for CORS
Release v3.8.2