Should set `withCredentials` to `true` on the XHR when fetching via `fetchXML` or `fetchZip`. Otherwise we cannot fetch protected/secured files.