settings: add forceAllowCredentials for XHR requests (close #100)