Fixed: #2157

Possible bug in XMLHTTPRequest.  Thanks to hmsimmonds for locating the following:

http://connect.microsoft.com/IE/feedback/details/795580/ie11-xmlhttprequest-incorrectly-throws-invalidstateerror-when-setting-responsetype

https://github.com/enyo/dropzone/issues/179

In short, setting the "withCredentials" flag must be done after open().

Refs: #2157