Pass through withCredentials option

I noticed that from `1.3.1` the `http-browserify` module supports setting the `withCredentials` option to false for requests.  This PR allows you to request that hyperquest does the same - which in my case is really useful :)