Cross-domain browserchannel with credentials

Hey joseph, 

This is my shot at using "withCredentials" and cross-domain connections. 

Everything here should be self-explanatory, except for a couple oddities: 

* writeHeader always "outsources" creating a dictionary of headers, so that "Access-Control-Allow-Origin" can be set to the origin of the request
* The option `cors` or `corsPattern` can be set. `corsPattern` will set "Access-Control-Allow-Origin" to the origin of the request, IFF the origin of the request matches the pattern. For example, you can do `corsPattern: /http[s]?:\/\/(.*\.|)spandex.io$/` to allow origins of www.spandex.io, spandex.io, serverX.spandex.io, etc (which is what I'm doing). Otherwise if cors == '*' this will happen anyway.

Hope that makes sense and I hope I haven't done anything too weird! Hopefully this will at least spark your imagination about how to do cross-domain/subdomain BC well.