added xhrFields option

We need this because we are using CORS and cross site RPC. 
CORS is an inherently safe method of doing XHR across sites.

Have not managed to write a test for this, sorry.

Hand tested the solution with chrome and firefox.