bug fix?
using POST to try to trigger CORS OPTIONS request
moved setRequestHeader call after open call