Work with CORS-enabled servers

[berezovskyi]

Modern JS code shall use fetch with credentials: "include" as per https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#including_credentials

The current code always sends GET requests without credentials to CORS-enabled servers, making the GET+CORS requests fail.

See also request/request#3142