Cross-origin CORS requests for the element will have the omit credentials flag set.