Support for the withCredentials bit of XHR, used with CORS