Set xhr.withCredentials after xhr.open to avoid INVALID_STATE_ERR

Apparently they changed that in the spec so it fails now on v8...

See https://groups.google.com/forum/#!msg/v8-dev/yYMQ1peZtLw/nbD7rV7ZMmgJ for some context.