xhook now passes `withCredentials` to underlying xhr