Although not specified on the main page, as per
b12a6245d9/tests/browser/test.js we can see that this is part of the request module.
More practically: local testing shows adding the {withCredentials:false} option allows us to create a request that accepts an "*" value for the Access-Control-Allow-Origin header.