Added withCredentials property to fake xhr

Cross browser pattern to detect if CORS is supported is to create a XHR using XMLHTTPRequest2 and see if “withCredentials” property is present. Without this property, tests that use fake XHR will go through the code path assuming that CORS is not supported. For example, the code below will ways always return null since the fake xhr in sinon.js does not have withCredentials.

```javascript
function createCORSRequest(method, url) {
  var xhr = new XMLHttpRequest();
  if ("withCredentials" in xhr) {
    //xhr2
    xhr.open(method, url, true);

  } else if (typeof XDomainRequest != "undefined") {
    //xDomain only exists in IE
    xhr = new XDomainRequest();
    xhr.open(method, url);

  } else {

    // CORS is not supported by the browser.
    xhr = null;

  }
  return xhr;
}

```