Describe the bug
XMLHttpRequest doesn't send Authorization header when withCredentials is false even if the request is same origin

To Reproduce
Steps to reproduce the behavior:

1. set url to some url http://localhost:8123
2. call an xmlhttprequest to the same origin with withCredentials: false and Authorization header

const req = new XMLHttpRequest();
req.addEventListener("load", reqListener);
req.open("GET", "http://localhost:8123/);
req.setRequestHeader("Authorization", "Basic asdf");
req.send();

3. Authorization header get's erased

Expected behavior
Authorization header is sent as per spec https://xhr.spec.whatwg.org/#the-withcredentials-attribute

Additional context
Add any other context about the problem here.