Moving xhr.open to before setting headers -- oops