Added xhrFields.withCredential = true to allow cookies to be sent

We need this option to allow the epicenter.token cookie to be used automatically in flow.js so it works with private/authenticated projects