Added with-credentials? to request map.

Modern browsers (at least Chrome and Firefox) prevent websites sending a CORS header with a wildcard Allow-Origin from processing the responses when xhr.withCredentials is set on the request. Being unable to disable sending credentials renders cljs-http unusable for public anonymous apis (like the GitHub example in the README). 

This patch adds a with-credentials? key to the request map (accepted by all instances of the client) and updates the README to show a working example.