XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
I agree with the code as it is. The developer should be able to set headers and deal with IE ignoring them without setting yet another option. A warning is certainly a step up from the usual silent failure!