No default withCredentials. Updated version of #47

Any reason to alter the default for xhr.withCredentials?