XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
Ah, that makes sense. How about this, then:

```
    var XHR = window.XMLHttpRequest || noop
    var XDR = window.XDomainRequest || noop

...

    var xhr = options.xhr

    if (!xhr) {
        xhr = new XHR()
        if (!("withCredentials" in xhr) && (options.cors || options.useXDR)) {
            xhr = new XDR()
        }
    }
```