XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I wanted to do that initially, I backed out because it would force the developer to add a try-catch in the code running in every browser even if they can set up the backend to get by without headers if dealing with IE. 

I'd gladly go back to throwing an error if we become sure it doesn't complicate the code that uses `xhr`