fixed theme endpoint CORS ajax calls
* changed them from POST to GET to get around a CORS issue
* added withCredentials: true to send cookies for session authentication