Add option to trigger xhr.withCredentials without http auth

Firefox sends the username for auth even though a password was not supplied
which causes Firefox to abort before sending a preflight request for Cross-Origin
requests.  

This pull request adds a withCredentials request option that allows you to set ``xhr.withCredentials`` without sending http authentication.

See http://stackoverflow.com/questions/11255173/firefox-wont-send-cross-origin-resource-sharing-pre-flight
See the last comment on the PR.


On Sun, Jun 29, 2014 at 11:31 AM, Craig Campbell <notifications@github.com>
wrote:

> In Source/Request/Request.js:
>
> > @@ -197,7 +198,7 @@ var Request = this.Request = new Class({
> >  		}
> >
> >  		xhr.open(method.toUpperCase(), url, this.options.async, this.options.user, this.options.password);
> > -		if (this.options.user && 'withCredentials' in xhr) xhr.withCredentials = true;
> > +		if ((this.options.user || this.options.withCredentials) && 'withCredentials' in xhr) xhr.withCredentials = true;
>
> @ibolmo <https://github.com/ibolmo> I think you are missing the point of
> this pull request. xhr.withCredentials does not require http
> authentication (as the current Mootools code suggests). You should be able
> to specify this flag without providing a username or password.
>
> From the spec
>
> The term user credentials for the purposes of this specification means
> cookies, HTTP authentication, and client-side SSL certificates.
> Specifically it does not refer to proxy authentication or the Origin header.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/mootools/mootools-core/pull/2486/files#r14330192>.
>