Moved .withCredentials after .open to prevent IE10 InvalidStateError bug.

Fixes #179