Default to setting withCredentials to false for proper CORS