XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
Maybe consider

```js
var XHRConstructor = options.cors || options.userXDR ? XDR : XHR
xhr = new XHRConstructor()
```