Then why wasn't credentialless a simple fix to solve that. Not sending cookies isn't hard.