update to has-cors 1.0.3

Fixes graceful fallback if XMLHttp request is disabled in IE

see issue #44

I think this might be as close as we will get to testing this. I ran the test suite in IE 8 with disabled XMLHttp request. The result is the `new XMLHttpRequest` throws. I only had to patch up `has-cors` to account for that and the test suite passes. We already have logic for a throwing XMLHttpRequest so I think we are all set.