always use XMLHttpRequest

current behavior will use XDomainRequest whenever it is available even though the request is not necessarily CORS. this creates a problem when on certain browsers (e.g. ie10) because:
- Access-Control-Allow-Origin header is expected despite the request not being CORS
- XDR does not have an onreadystatechange function (http://msdn.microsoft.com/en-us/library/ie/cc288060(v=vs.85).aspx) and use of its proper callback functions appear to have not yet been implemented