Support XMLHttpRequest withCredentials property

There are flags on the XHR that are important to set correctly in certain
contexts. The 'withCredentials' property used by CORS is one example. As
the context is essential, there is no good default value, thus we need to
make it open to configuration. Rather than explicitly support each property,
the xhr client now supports `request.mixin` which will copy all its
properties directly on to the raw XHR object.

Issue: #40