AGJS-201 Sinon.JS XMLHttpRequest#response workaround

not to be merged - just for discussion. rebase is needed and authentication unit tests should be improved according the test improvements @lholmquist made in AGJS-200 (reuse sinon.js server responses)

if you're fine with the workaround for Sinon.JS XMLHttpRequest#response, I'll update the PR so that the authentication unit tests are re-using the Sinon.JS server responses