Deprecate setting xhr.withCredentials flag from HTTP auth
Add unit tests for xhr.withCredentials behavior