bump xmlhttprequest to allow setDisableHeaderCheck