fix!: change credentials mode from "omit" to "same-origin" when set to false

[lukas-reining]

Changes the default value of the credentials option in fetch.
Until now, it was set to omit if the withCredentials was falsy, as @oatkiller pointed out in #26.
As per the spec, this value should be same-site by default and include if the withCredentials option is set to true.

Reference: https://html.spec.whatwg.org/multipage/server-sent-events.html#dom-eventsource-withcredentials-dev

Caution

This is a breaking change, as users with withCredentials not set or set to false, will now send cookies to same-site instead of sending not them.
Be sure that this is acceptable for your use case.

Tip

If the credentials mode should still be set to omit, you can set the omitCredentials parameter to true.
If withCredentials is also set to true, omitCredentials will take precedence.