Allow xhr options to be passed (e.g., withCredentials)

[parente]

This issue (and a few others I'm going to open) are born out of our experience so far using Thebe for the https://github.com/jupyter-incubator/dashboards prototype. You could easily tell me "it's out of scope" for Thebe and I'll believe you, but I figured I would report it. :)

If I want to run my kernel provider (e.g., tmpnb) behind a proxy that, for example, requires auth headers to be sent along with XHR requests, I have to hack the code to set the withCredentials flag. Likewise, if I have a setup in which I need to send additional headers, I have to hack the code. It would be nice if these comm options could be set without touching Thebe.

Of course, I recognize that the code pulled from jupyter/notebook doesn't accept these as parameters. I'm planning to open this issue in jupyter/jupyter-js-services as well.