Pass credentials as well (needed for the ajax workaround)