Fix bug : xhr should use withCredentials flag on client side