[Fix csrf header] setRequestHeader must be called after the http.open call

@javruben