Add option to trigger xhr.withCredentials without http auth

Firefox sends the username for auth even though a password was not supplied
which causes Firefox to abort before sending a preflight request for Cross-Origin
requests.  

This pull request adds a withCredentials request option that allows you to set ``xhr.withCredentials`` without sending http authentication.

See http://stackoverflow.com/questions/11255173/firefox-wont-send-cross-origin-resource-sharing-pre-flight
@ibolmo this is failing in [some browsers](https://travis-ci.org/mootools/mootools-core/jobs/28801324) with `Expected undefined to be false.`

Can we cast to boolean and use `expect(!!request.xhr.withCredentials).toBe(false);` ?