Cross-origin CORS requests for the element will not have the omit credentials flag set.