+ // TODO: fetch is simpler, but does not set req.xhr (for security check)
+// fetch(params.serverUrl + "/whoami", {
+// method: "GET",
+// credentials: params.cors ? "include" : "omit",
+// }).then((res) => {
+// return res.json()
+// }).then((user) => {
+// this.state.user.email = user.email;
+// this.state.user.notify = user.notify;
+// });