Add credentials to xhr request