CORS withCredentials move to xhr open state


According to [w3 spec](http://www.w3.org/TR/XMLHttpRequest2/#the-withcredentials-attribute) the XHR state should be open or unsent when setting the withCredentials flag.
So I have moved the flag to after `xhr.open`.

Running superagent without this change in PhantomJS 1.9.2-5 causes
`INVALID_STATE_ERR: DOM Exception 11`

[Related SO post](http://stackoverflow.com/questions/3488698/invalid-state-err-dom-exception-11-webkit)