Added withCredentials=true to XMLHTTPRequest for login