XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I'd prefer we just throw if `useXDR` is set because it's a bug.

But :+1: on documenting that you cants set headers on XDomainRequest in the README.