XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
So looks like you can't set headers. Instead of doing ` console.warn` can we throw an exception.

```js
} else {
  if (options.headers) {
    throw new Error('XDR doesn\'t support custom headers in requests')
  }
}
```