added xhr with creds