XHR withCredentials configurable

closes #173