bump xmlhttprequest version to allow setDisableHeaderCheck