use withCredentials: true on all ajax requests where cookies may be
needed for successful CORS requests.