Enabled xhrFields to pass the credentials on SSO authenticated environments

[cmanaha]

Additional xhrFields : { withCredentials: True} added to the connection

[philipskokoh]

Thanks @sjuvonen for pointing out this issue.
I revert back the PR for now, will get back to address this issue later.

[nz]

withCredentials should be set to true only when actually using credentials.

Some more input on this: withCredentials is needed when you want to pass the entire session with cookies. For best results with CORS, you can do fine by setting an Authorization header, and leave withCredentials = false.

As an ES hosting provider, I definitely don't want people accidentally sending us their users' sessions over HTTP :-)

I helped build out CORS support on bonsai.io and definitely bumped my head on this a few times, happy to help support any efforts around it.