XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I want to resolve `window.XMLHttpRequest` once globally at the top of the file rather then every single time `xhr()` is called.