Allow setting xhr.withCredentials

Replaces the pull request #4098. Also see discussion #4082.