Set xhr.withCredentials after xhr.open()