enforce IE10's (misguided) implementation of xhr spec: require readyState == OPENED for setting withCredentials in our fake XHR library