update xmlhttprequest dependency

I really wish you could bump to xmlhttprequest version. ```1.5.0``` has a ```setDisableHeaderCheck```` that allows me to pass a cookie in there.. This allows me to monkeypatch xmlhttprequest to use the cookie I want so I can authenticate my client as shown in this gist:

https://gist.github.com/4087861


thank you very much