requestFactory() breaks in IE with ActiveX disabled

Steal's `requestFactory()` breaks with an error `Automation server can't create object` with IE10 and ActiveX disabled. We actually came across this when using WebView in a Windows 8 Metro app (WebView seems to have ActiveX disabled, [see reference](http://social.msdn.microsoft.com/Forums/windowsapps/en-US/0218fdc8-9465-4a8a-878d-92a49524e932/get-error-javascript-runtime-error-automation-server-cant-create-object-when-i-use-webview-to-get?forum=winappswithcsharp)), but the same behavior can be reproduced by using IE10 and disabling ActiveX in Internet Options > Security > Custom level... > ActiveX controls and plug-ins.

In this fix, we reverse the order - try `XMLHttpRequest` first, and then try `ActiveXObject`. This is the same order that jQuery 1.9 uses (see https://github.com/jquery/jquery/blob/1.9-stable/src/ajax/xhr.js#L35) and works without error even when ActiveX is disabled.

Tested in Chrome and IE10 (with and without ActiveX disabled), and IE10 compatibility modes for IE9 and IE8. We tested on a page that uses steal to grab an .ejs template, which causes steal.request() to be called.

Note that `steal.production.js` was updated to match the change.