Remove credentials from Api XHR requests