Tested with jquery master from github and Firefox 30 and Chrome 35 beta.

The preflight OPTIONS request is not sent when credentials are specified

as arguments to XMLHttpRequest.open().

Manually adding the "Authorization" header works in both browsers; i.e.: the OPTIONS request is sent before the actual response.

The point of the examples below is to demonstrate that the required OPTIONS requests is sent by the browsers in case 1) but not in case 2). Both requests fail to actually load the content because the *server's response* to the OPTIONS request is wrong.

1) OPTIONS request is correctly sent

    var url = "https://test-cors.appspot.com/";
    var username = "foo";
    var password = "bar";

    var xhr = new XMLHttpRequest();
    xhr.open('GET', url, true);
    xhr.withCredentials = true;
    xhr.setRequestHeader("Authorization", "Basic " + btoa(username + ":" + password));
    xhr.send(); 

2) OPTIONS request is *not* sent

   var url = "https://test-cors.appspot.com/";
    var username = "foo";
    var password = "bar";

    var xhr = new XMLHttpRequest();
    xhr.open('GET', url, true, username, password);
    xhr.withCredentials = true;
    xhr.send();