* Add the withCredentials configuration key

It enables passing credentials in CORS requests. e.g. Cookies and
Authorization headers.

* Improve withCredentials documentation

* Add unit tests for the withCredentials config

* Update configuration.md

* Update configuration.md

* only set `withCredentials` Fetch flag if the config value is truthy

there are some workarounds in the wild today that involve setting `withCredentials` on `system.fn.fetch` directly. 

this approach avoids mangling those existing workarounds!

* add more test cases

* Update configs-wrap-actions.js

* Update index.js

* improvement: expose docExpansion setting as a prop in swagger-ui-react

* Update README.md

* Update index.js

* Update README.md

* Update README.md

* expose swagger object so it can be controlled in the onComplete function

* docs: swagger-ui-react onComplete system argument

* Remove react-addons-perf dependency

* update lockfile

* include ReactPerf in non-production builds

* bug: fix pre styles for block code

* bug: Fix badge padding

* create Markdown-specific stylesheet

* Update Cypress version

* regenerate package-lock.json

* fix: use npmrc auth for React module publishing

* revert removal

* swagger-ui-react alpha.0

* alpha.1

* alpha.2

* alpha.3

* begin updating README

* alpha.4

* WIP: `displayOperationId` support

* move loading error readouts to BaseLayout

* add `url` prop

* export React component as default

* add interceptor support

* modify docs markup

* add `onComplete` prop

* add `spec` prop

* Update README.md

* alpha.6

* remove independent manifest; build releasable exclusively from template

* ensure dist is present; drop config field in manifest

* drop alpha field

this script is now able to release to npm!

* remove unused selector references

* Update README.md

* fix: prevent subtree paths from being queued more than once in a batch

* fix: clear subtree resolver errors by current path

* drop `List` import

* fix: gracefully handle non-string operation summaries

* use lodash for more summary type safety

* fix: sanitize URLs used for OAuth auth flow

* embetter test case

* fix linter issue

* improvement: operation path + summary overflow styling

* inject zero-width spaces for better path breaking

* migrate 4867 regression test to tolerate new ZWSPs

* rm `dev-helpers/doc.yaml`

* Update lodash

fix for Regular Expression Denial of Service:
https://snyk.io/vuln/SNYK-JS-LODASH-73639

* update lockfile

* `schema` -> `structural`

* drop strip-instance transformer

* coerce multipart initial property values to string

* add tests

* fix: don't trigger `url` remote document load if `urls` is provided

* better test block title

* fix: handle malformed global tags array in taggedOperations

* handle non-array global tags as well

* update test imports

* remove stray brackets

* add no-cache option for smaller images

* move flag immediately after `apk`

adjusting to be as close to the example as possible: https://github.com/gliderlabs/docker-alpine/blob/master/docs/usage.md#disabling-cache

* add React compatibility issue
* Update README.md

* add failing tests
* standardize parameter keying
* validateParam test migrations
* migrate test cases to new pattern
* disambiguate name/in ordering in `body.body` test cases
* `name+in`=> `{in}.{name}`
* consider allowEmptyValue parameter inclusion in runtime validation
* use config object for all validateParam options
* drop isXml flag from validateParams

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:url-parse:20180731

no PR too small!