explain that read-only API is authenticated, and inclusion of cookies
in XHRs from foreign origins