cors preflight not sent when credentials are specified as args to xhr.open()