xhr credential headers for Client-side requests