have all xhrs use withCredentials