I added  withCredentials  to my front-end request, even though I deployed the front and back ends separately. 
 assume that the front end is deployed at  web.xxx.com  
 and that the back end is deployed at  service.xxx.com  
I define all api as web, so I can authenticate users by setting cookie, and I can temporarily store data in session in back-end code.
