Fix for 3xx redirects; Disabled credentials
Added demo; Add original status at 333 redirects
Clean-up of unused methods
Location -> X-Location

xhr.getResponseHeader('Location') gives:
> Refused to get unsafe header "Location"
Improved demo, optimized server.js for Heroku