fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

frontend/app/javascript/v3/api/apiClient.js

@@ -1,6 +1,6 @@
 import axios from 'axios';
 
 const { apiHost = '' } = window.chatwootConfig || {};
-const wootAPI = axios.create({ baseURL: `${apiHost}/` });
+const wootAPI = axios.create({ baseURL: `${apiHost}/`, withCredentials: true });
 
 export default wootAPI;