catch "xhr.withCredentials = true" if not supported