Authenticate JS xhr calls with authentication tokens