Forgot to mention that if i open that URL from the browser window I get the expected result in the JSON, the response contains
"isAdmin": true,
"isLoggedIn": true,
It looks like if the browser does the request in the page via the javascript, could not access the cookies and so it gets a "logged out" json (but i tested on clean ms edge with no cookie blocking)
Ps: i could not edit the other post because of a weird issue, I'm going to open another post to ask if this is intended behavior