XDR handling separated from withCredentials, fixed #35

Take a look before I merge it.
There's no such thing as too much peer review.
you don't add a try catch. If you set headers on a cors request and want to support IE9 you shouldn't set headers. This throw exception is a programmer error not an operational error

Although we might want an option of 'forceHeaders'

```js
if (options.headers && !options.forceHeaders) {
  throw
}
```