Make `withCredentials` a param allowing caller to set

Wasn't sure if there was a solid reason for forcing `withCredentials` to be true and thought it would be useful to make a param. I am working with a server that doesn't support the credentials header.