Hide XMLHttpRequest's private state using Symbol

It's not really hidden because you can reflect out the symbols, but this is a
start. We might use a WeakMap in the future if we really need hiding.

R=esprehn@chromium.org

Review URL: https://codereview.chromium.org/753473002