fixed withCredentials on new browsers, closes #18