title: 403 Forbidden: Able to open uri in browser but not in JavaScript code
body: <p>I'm trying to open a (cross domain) uri in my JavaScript code. I'm able to open it if I copy it to my browser and directly open it. However, if I open it in my JavaScript code, I get 403 Forbidden error. Here is my code:</p>
  
  <pre><code>var xhr = new XMLHttpRequest();
  xhr.responseType = 'json';
  xhr.withCredentias = true;
  xhr.open('get', uri, 'true');
  xhr.onload = function() {
      console.log(xhr.response);
  }
  xhr.send();
  </code></pre>
  
  <p>It doesn't seem like a CORS error, because in the response header I can see my origin host in the Access-Control-Allow-Origin part. I didn't get any CORS error either.</p>
  
  <p>Does anyone have any idea why this happens? Really appreciate your help!</p>
  
  <p>Thanks!</p>
  
  <p>====UPDATE====</p>
  
  <p>Directly from browser (Chrome)</p>
  
  <pre><code>Request:
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Encoding:gzip, deflate, sdch, br
  Accept-Language:en-US,en;q=0.8
  Cache-Control:no-cache
  Connection:keep-alive
  Host:host.com
  Pragma:no-cache
  Upgrade-Insecure-Requests:1
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
  
  Response:
  Cache-Control:max-age=60
  Connection:Keep-Alive
  Content-Encoding:gzip
  Content-Type:application/json; charset=utf-8
  Date:Mon, 01 Aug 2016 17:58:20 GMT
  Expires:Mon, 01 Aug 2016 17:59:20 GMT
  Keep-Alive:timeout=5, max=100
  Server:Apache/2.4.6 
  Transfer-Encoding:chunked
  Vary:Accept-Encoding
  </code></pre>
  
  <p>From code</p>
  
  <pre><code>Request:
  Accept:*/*
  Accept-Encoding:gzip, deflate, sdch, br
  Accept-Language:en-US,en;q=0.8
  Cache-Control:no-cache
  Connection:keep-alive
  Host:host.com
  Origin:myhost.com
  Pragma:no-cache
  Referer:myhost.com/login
  User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
  
  Response:
  Access-Control-Allow-Credentials:true
  Access-Control-Allow-Methods:GET, HEAD, OPTIONS
  Access-Control-Allow-Origin:myhost.com
  Cache-Control:max-age=60
  Connection:Keep-Alive
  Content-Length:0
  Content-Type:application/json; charset=utf-8
  Date:Mon, 01 Aug 2016 18:20:54 GMT
  Expires:Mon, 01 Aug 2016 18:21:54 GMT
  Keep-Alive:timeout=5, max=100
  Server:Apache/2.4.6
  </code></pre>