Don't send credentials on Firefox

Reddit doesn't send Access-Control-Allow-Credentials headers (at least
not on GET requests; I'm guessing it doesn't on POST requests either),
set xhr.withCredentials to false so that it doesn't error out.