Adds withCredentials as option to core-xhr and attribute to core-ajax

This way those of us who want to make CORS `withCredentials` requests may do so.