XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I'd prefer a whitelist of headers IE9 supports with XDR and throwing for any other headers.