Add support for CORS / XHR

This is ready to be looked over now.
perhaps ```if (xhr && 'withCredentials' in xhr)``` would read better as a condition?