fix: [#1631] Set fetch credentials to same-origin for xhr when withCredentials is false

fix: [#1631] Set fetch credentials to same-origin for xhr when withCredentials is false #174