Add option to trigger xhr.withCredentials without http auth

Firefox sends the username for auth even though a password was not supplied
which causes Firefox to abort before sending a preflight request for Cross-Origin
requests.  

This pull request adds a withCredentials request option that allows you to set ``xhr.withCredentials`` without sending http authentication.

See http://stackoverflow.com/questions/11255173/firefox-wont-send-cross-origin-resource-sharing-pre-flight
@ccampbell we have encrypted user/pass to sauce labs testing. That means pull requests are only tested against PhantomJS on Travis. We should maybe change that so that pull requests actually get tested in browsers and not only after merge.

Anyway, this is a detail, I am really happy you proposed this fix.