- TEST: add 'withCredentials' to the XHR