IE 8-9 CORS request

Tests show XMLHttpRequest does not sent the origin header,
XDomainRequest does.

See

http://blogs.msdn.com/b/webdev/archive/2013/10/28/sending-a-cors-request
-in-ie.aspx