Add withCredentials option. Fix #29

> The spec says withCredentials should default to false, so that's what people expect

The spec has an annoying default, xhr defaults to true because that's what you want. Also I don't think breaking back compat is a good idea. Note that it should still be optin by setting `cors` to true, so it DOES default to false

> Also, the wildcard is not allowed in Access-Control-Allow-Origin when it's set to true.

The wildcard was always a bad idea, no production service should be using it.