monkey patch XMLHttpRequest to add header