Pass withCredentials to request

This got removed, and it breaks in browser with CORS.  Browser-request needs to get it from the options object.