Make sure all API call use "withCredentials".