Add xhrChallengeType option

Browsers such as Safari intercept 401 Unauthorized responses with the Basic challenge. In client side apps using XHR requests this creates a browser authorization dialog before you can handle the error in your own code.

The way around this is to change the challenge type on XHR requests. See the below links for more info:
http://stackoverflow.com/questions/86105/how-can-i-supress-the-browsers-authentication-dialog/20221330#20221330
http://loudvchar.blogspot.ca/2010/11/avoiding-browser-popup-for-401.html

I've added the `xhrChallengeType` option which works around this. Also added a test and updated the readme.