Automatically set `xhr.withCredentials = true` when we make cross-domain requests

I noticed there wasn't an easy way to pass the cookies along with superagent when you make a CORS requests.

jQuery's AJAX library has support for it, but it's really wonky. I thought this would be a nice feature for superagent.

I thought about just adding a method to modify the raw XHR request, something like:

```
    request
      .get('api.github.com')
      .xhr('withCredentials', true)
      .end(...)
```

... but I was looking at the other xhr fields and it looks like superagent covers most the other fields internally. I think adding `withCredentials` automatically could help prevent future CORS-related headaches.

Anyway, superagent is an awesome library and I hope this helps! Let me know if you want me to change something.