I did not remove the event listener because the XMLHttpRequest object can be re-used by calling `.open` multiple times. When this happens, `this.readyState` can become 1 again.

Should I still remove the event listener?
If not, should I move `xhr_onreadystatechange` outside the closure (only the XHR instance, `this` and the (already global) `isInPrivateBrowsing()` methods are needed)?