Add option to trigger xhr.withCredentials without http auth

Firefox sends the username for auth even though a password was not supplied
which causes Firefox to abort before sending a preflight request for Cross-Origin
requests.  

This pull request adds a withCredentials request option that allows you to set ``xhr.withCredentials`` without sending http authentication.

See http://stackoverflow.com/questions/11255173/firefox-wont-send-cross-origin-resource-sharing-pre-flight
@ibolmo I think you are missing the point of this pull request.  `xhr.withCredentials` does not require http authentication (as the current Mootools code suggests).  You should be able to specify this flag without providing a username or password.

From the spec

> The term user credentials for the purposes of this specification means cookies, HTTP authentication, and client-side SSL certificates. Specifically it does not refer to proxy authentication or the Origin header.