Prevent IE10 InvalidStateError

In IE10, as per spec, withCredentials must be set AFTER xhr.open() 

Other browsers [incorrectly, but gently] ignore this violation.
Merge pull request #8 from dymonaz/patch-1

Prevent IE10 InvalidStateError