Allow setting xhr.withCredentials to true

As dicussed in issue #4082