Explicit cookie header/form - a2/PebbleBucks#1

I'll start by saying I don't entirely know why this seems to fix the issue. Want to dive in a little deeper but figured—after seeing success for the last 12 hours or so—I'd open the PR anyway.

I noticed that it was only the first request that seemed to fail consistently. Any subsequent fetch for a few minutes after a failure seemed to work.

I inspected the second xhr and saw that it was falling back to the login screen. Since we're executing in a webview, I could explicitly grab the `Set-Cookie` from the first xhr's response, and stuff it into the second xhr. I assumed this would happen automatically but, frankly, am not 100% certain since we're running in a different origin—i.e., not starbucks.com. Worth mentioning here that `withCredentials` didn't seem to have any effect.

I decided to add the mime type as well since that's what seemed to work when running the JS in my browser.

For some reason, this combination seems to have resolved the issue for me. I can't explain it but it does. Frankly, I still have some work I want to do to confirm more conclusively (e.g., see what headers were / weren't being set previously by the webview, etc) but thought I'd open this to start collecting more feedback being my anecdotal observations.