CORS support by reimplementing XmlHttpRequest with support for 'withCredentials'