Fix for #2256

Created by: dsparacio

honor protection data’s withCredentials value. The only question is should I preserve this in some cases or should we always enforce the explicit setting via protection data?

if ('authorization' === key.toLowerCase()) { xhr.withCredentials = true; }