use credentials for xhr and bump version