XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I scratched an itch here. Lost some time debugging why IE9 wouldn't send headers before I went back to docs to find out it just doesn't.