Add withCredentials to XHR object

 - This enables us to use with cookies across domains
 - Maybe we want to set this optionally, but I see no downside in having it enabled all the time.