XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
Damn, you got me. But it's IE so it's probably leaking already, though, right? :grinning: