Add withCredentials option. Fix #29

Oh that would be bad actually. What we want is 

`if (options.cors && options.withCredentials !== false) {`

Meaning opt into cors & opt out of withCredentials