XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
What about `if (options.headers && options.useXDR) {`

This way the exception is opt in via the `options.useXDR` flag.