Fix bug : xhr should always use credentials on client side