To get working needed: Authorization vs Authentication header to be set. And "credentials: include".

All seems to work, just updated text and the fetch response here for the sandbox demo.