Tip: If the request depends on cookies/session, you must run the script on the same origin you captured it from so the browser sends the right credentials.