fetch sends no cookies unless you ask

XMLHttpRequest sends cookies to the same origin by default. fetch does not, so a session-authenticated endpoint that worked with jQuery returns 401 after the migration and looks like an authentication bug.

fetch('/api/me');                                  // no cookies
fetch('/api/me', { credentials: 'same-origin' });   // cookies, same origin
fetch('/api/me', { credentials: 'include' });       // cookies, cross-origin too

include on a cross-origin request also requires the server to send Access-Control-Allow-Credentials and a specific origin rather than *, and getting one of those wrong produces a CORS error that says nothing about cookies. The default changes to same-origin in later browsers, which means code written now behaves differently depending on when it runs — set it explicitly.