Add withCredentials option. Fix #29

See substack/http-browserify#47, which I mentioned in #29. The [spec](http://xhr.spec.whatwg.org/#the-withcredentials-attribute) says withCredentials should default to false, so that's what people expect. Also, the wildcard is not allowed in Access-Control-Allow-Origin when it's set to true.