Allow cookies over CORS

Should this be the default, or should we make it configurable?

> Standard CORS requests do not send or set any cookies by default. In order to include cookies as part of the request, you need to set the XMLHttpRequest’s `.withCredentials` property to true

– http://www.html5rocks.com/en/tutorials/cors/