Prevent IE10 InvalidStateError

In IE10, as per spec, withCredentials must be set AFTER xhr.open() 

Other browsers [incorrectly, but gently] ignore this violation.