XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
The new XHR and XDR vars (and the possible assignment of XHR to XDR) muddled my understanding when I first read through index.js. How about we get rid of them and substitute the section in createXHR with the following:

```
    var xhr = options.xhr

    if (!xhr) {
        xhr = window.XMLHttpRequest ? new window.XMLHttpRequest() : {}
        if (!("withCredentials" in xhr) && (options.cors || options.useXDR)) {
            xhr = new window.XDomainRequest()
        }
    }
```