Add withCredentials header for CORS