get XMLHttpRequest at call time

so that we can replace if we want to, such as when mocking