(where credentials has a technical meaning in CORS; if the authorization header is constructed manually it isn't triggered, and *most* xapi content does this, but some does not)