Fix to include credentials on initial JSON request cross-domain, removing session from Spring Security usage