in order to have fully-featured XHR requests for CORS-enabled API servers, we need to add `WithCredential` options to enable clients to send requests with stored credentials in cookies or headers. more info here: https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials