FIX: pass in username/password into xhr if credentials are available
2nd iteration on CORS-related issue + analysis + rationale
merge cleaned up stardog.js