Fix JS fetch credentials and CSV export from web UI

server/templates/admin_users.html

@@ -69,6 +69,7 @@ document.getElementById('create-user-form').addEventListener('submit', async (e)
     const res = await fetch('/api/auth/users', {
         method: 'POST',
         headers: {'Content-Type': 'application/json'},
+        credentials: 'include',
         body: JSON.stringify({
             username: document.getElementById('new-username').value,
             password: document.getElementById('new-password').value,
@@ -91,6 +92,7 @@ document.querySelectorAll('.change-role').forEach(btn => {
         const res = await fetch(`/api/auth/users/${btn.dataset.id}`, {
             method: 'PATCH',
             headers: {'Content-Type': 'application/json'},
+            credentials: 'include',
             body: JSON.stringify({role: newRole}),
         });
         if (res.ok) location.reload();
@@ -105,6 +107,7 @@ document.querySelectorAll('.reset-password').forEach(btn => {
         const res = await fetch(`/api/auth/users/${btn.dataset.id}`, {
             method: 'PATCH',
             headers: {'Content-Type': 'application/json'},
+            credentials: 'include',
             body: JSON.stringify({password}),
         });
         if (res.ok) alert('Пароль изменён');
@@ -115,7 +118,7 @@ document.querySelectorAll('.reset-password').forEach(btn => {
 document.querySelectorAll('.delete-user').forEach(btn => {
     btn.addEventListener('click', async () => {
         if (!confirm(`Удалить пользователя ${btn.dataset.username}?`)) return;
-        const res = await fetch(`/api/auth/users/${btn.dataset.id}`, {method: 'DELETE'});
+        const res = await fetch(`/api/auth/users/${btn.dataset.id}`, {method: 'DELETE', credentials: 'include'});
         if (res.ok) location.reload();
         else alert('Ошибка удаления');
     });