Revert "Remove "withCredentials"."

This reverts commit bcfbacbd4f27eb8200bd286f70d78c2c934e4c8e.

The problem is actually that Discourse broke their CORS in this commit:
https://github.com/discourse/discourse/commit/46c406360d7ac851a3f4977f89178c5480cc063b

Needs to be fixed there, not on our end.