Javascript: Display Image Fetched Through Authenticated REST API

I have a protected REST endpoint in Oracle Content and Experience Cloud, which returns image/png. Let's display it.

var imgUrl = "https://foo.barcloud.com/documents/api/latest/files/FA5A98CDC6482BD3ED6CFEA98CD980E/data/thumbnail";
var user = "foobar";
var pass = "Yolo6969";

// @see https://stackoverflow.com/a/17682424/357403

var xhr = new XMLHttpRequest();

// Success
xhr.addEventListener("load", function __xhrLoaded() {
    var img = document.getElementById('thumbnail');
    // This will create the DataURI for us.
    var URL = window.URL || window.webkitURL;

    switch (this.responseType) {
    case "arraybuffer":
        // createObjectURL only accepts Blob.
        img.src = URL.createObjectURL(new Blob([ this.response ], { type : this.getResponseHeader('Content-Type') }));
        break;
    case "blob":
        img.src = URL.createObjectURL(this.response);
        break;
    default:
        console.error("Unsupported response type: ", this.responseType, " -- expected binary types for image data.");
        break;
    }
});

// Failure
xhr.addEventListener("error", function __xhrFailed() {
    console.log("Request failed.", this);
});

// open (method, uri, isAsync, user, passwd)
xhr.open('GET', imgUrl, true, user, pass);
// Yes, I want to authenticate.
xhr.withCredentials = true;
// I want to authenticate right now.
xhr.setRequestHeader("Authorization", "Basic " + btoa(user + ':' + pass));
// Give me a Blob in the `response` field.
xhr.responseType = "blob";
xhr.overrideMimeType("image/png");
// Execute the action.
xhr.send();