Avoid spec in old browsers

Avoid spec in old browsers that don't support `withCredentials`