XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
But if useXDR is false the exception won't be thrown anyway because xhr will never be an XDomainRequest. What if we let the rule of silence rule and drop the else clause, but add a line to the options.headers section of the README like 

"Note that headers cannot be set on an `XDomainRequest` instance."