wrap cross-browser CORS xhr(xdr) in $q