Mixin XHR properties before and after opening request

As suggested by @fidian in #79, withCredentials needs to be mixed into
the request before opening. IE requires that timeout be set after opening
the request.

Now request.mixin values are mixed into the XHR object before before and
after calls to xhr.open(). Errors setting properties (like timeout in IE
before calling .open()) are ignored.