Long story short: I just checked in a change that adds a new abstract method to the relief.rpc.Command class called "requestXhrIo". Your command objects can override this method to receive the XhrIo instance prior to the request going to the server. So, for your particular use-case, you would add the following to your command object:
your.commands.NeesCredentialsClass.prototype.requestXhrIo = function(xhrIo) {
xhrIo.setWithCredentials(true);
};
Please test this out and let me know if it suits your needs. I don't have any familiarity with this API, so any testing I could do would probably be incomplete and ineffective.
Long story long: The goog.net.XhrManager, which the RPCService uses, maintains a pool of XhrIo instances. At the time a request is made, all of these pooled instances may be busy. Because of that, the control flow is asynchronous and so there is no way to access the XhrIo instance when you call "rpc.execute(cmd)". The XhrManager dispatches an event when an XhrIo becomes available. The RPCService listens for that event and then calls your command object's "requestXhrIo" method with the XhrIo object before executing the request.
I wanted to come up with a generic solution to this problem instead of just adding a "withCredentials" property to the Command class. While I do like the Command API as it is now, I believe it's already on the brink of having too many moving parts. By adding a method that allows users to do whatever they want with the XhrIo before the request, I avoid running into a situation where I have to add this property now, and some other property later, and another one down the road.
I try to be very aware of how these APIs are for developers and would be happy to hear any feedback you have after trying this out.