Allow XMLHttpRequest withCredentials to be set prior to a call to open()