fix: apply withCredentials for sync requests (#168)

[Hoang130203]

Problem

Fixes #168

withCredentials was silently ignored for sync requests. The option was set inside an if (!sync) guard:

xhr.open(method, uri, !sync, options.username, options.password)
//has to be after open
if(!sync) {
    xhr.withCredentials = !!options.withCredentials  // ← sync requests never reach this
}

This guard was introduced to work around a Firefox crash when withCredentials was always forced true on sync requests — regardless of what the user passed.

Root cause distinction

The original crash was caused by unconditionally setting withCredentials = true on sync requests. The fix over-corrected by removing it entirely for sync.

The real safe behaviour is: only set withCredentials when the caller explicitly opts in. Setting xhr.withCredentials = false (the default when options.withCredentials is falsy) on a sync request does not trigger the Firefox crash, and setting it true only when the user asks for it is safe in all modern browsers.

Fix

Remove the if (!sync) guard so withCredentials is applied consistently for both sync and async requests:

xhr.open(method, uri, !sync, options.username, options.password)
//has to be after open
xhr.withCredentials = !!options.withCredentials  // applied for all requests

This is consistent with how jQuery handles it and matches the behaviour a user would reasonably expect.