Set withCredentials explicitly, default to true if req.host != document.location.host
1.0.17