Fix XHR support for (CORS) digest auth

from Mozila foundation: "Indicates whether or not cross-site Access-Control requests should be made using credentials such as cookies or authorization headers. The default is false."