CORS: Use async XHR instead of sync for withCredentials
CORS: Don't check response code on OPENED status