Add credentials kwarg to support CORS + basic auth

If we set the `withCredentials` flag on an XMLHttpRequest request:
```
xhr.withCredentials = true;
```
the browser will handle HTTP basic auth for us, presenting the usual username/password dialogue to the user and handling the subsequest authentication cookie. To show support for this, the server must respond with an additional CORS header:
```
Access-Control-Allow-Credentials : 'true'
```
See the ['withCredentials' section of this post](http://www.html5rocks.com/en/tutorials/cors/) for more details.

This PR simply adds a kwarg to the `crossdomain` decorator which adds this header if the user requests it (default to `False`)