Change ajax requests to use form data and withCredentials for CORS

We can't use JSON data as the CORS request also causes the portal to return
a redirect, and this is disallowed by CORS specification.
Remove cohort-checking