fix: `onload` being called twice

As the title says, we found that `onload` was being called twice for all FakeXMLHttpRequest objects, and this was causing some weird behaviour.

This PR fixes that and updates the relevant test to ensure `onload` is called once and only once.

+ @maxmurdoch @harrison