Add some info about cors and withcredentials