XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
you actually need to run this in IE9 to get it tested, but the test will pass in other browsers.