Graceful handling of IE cross-domain AJAX failures

Prior to IE 10, XmlHttpRequest cannot be used for requests to a
different origin even when the target URL's CORS headers would allow
access (see http://caniuse.com/#feat=cors).

This is easy to miss in testing if you use a single origin during
testing but have a CDN or domain-sharding for production and will break
the error handler function passed to makeAjaxRequest() if that code
assumes it can access properties on the request object.

This adds a more informative pointer to Microsoft's documentation when a
security exception is raised.
Graceful handling of cross-domain tilesource failures on IE<10

The TileSource error handling path used to raise non-obvious
"Unspecified error" exceptions on IE < 10 when configured with a URL
from a different origin (hostname or port) because the handler included
``xhr.status`` in the error message, triggering a security exception.

Now the second exception is caught and the log message will use the
original exception message instead to make the root cause more obvious.