One solution I found is that might work is using this lib. I tried it out on a simple webpage and seems to be working so now going to test it from within Construct.
Which allows me to use xhr.withCredentials = true on requests to include the cookie data. Will be trying it out today and see if it helps. It should also work from node.js
Ashley is it much work to the xhr.withCredentials = true option in the AJAX plugin? Is it possible to get better support for cross domain requests in the near future?