set withCredentials required for js auth