setRequestHeader must be called after the http.open call
Merge pull request #98 from ajaxorg/better-csrf

[Fix csrf header] setRequestHeader must be called after the http.open call