CORS/CSRF basic check
URL / Method / withCredentials
withCredentials:
Check
Content-Type header value:
POST's body (if any):