Add option to make withCredentials false

Looks like it fixes the CORS exception