wp-admin AJAX with Fetch API is done without user

After some fiddling and sparring with @t-todua I found the issue:

With the Fetch API fetch call you must manually set to send cookies with a request. After setting the credentials option properly the cookies were sent and the AJAX endpoint recognized the current user. So the JS becomes:

var msg = '';

// I'm using the whatwg-fetch polyfill and a polyfill for Promises.
fetch(ajaxurl, {
    method: 'POST',
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8'
    },
    body: 'action=foobar_action&_wpnonce=" + window.custom_nonce,
    credentials: "same-origin'
}).then(function (res) {
    msg = res.json().msg;
});