Add withCredentials option. Fix #29

Thanks, I wasn't aware of the best practice there, and I imagine I'm not the only one. Maybe worth a word in the README? Do you have any good resources around this issue to point at?

In the meantime I'll change it to default to true.