Documented withCredentials in api.js