IE10 should prefer using CORS over XDR because it's safer