Make fetch() use "same-origin" credentials by default