Restrict support for XDR to IE 8-9

Restricting support for XDR to IE 8 and 9 since IE 10 also seems to have
`window.XDomainRequest` available and not really necessary for CORS.