Set xhr attributes after xhr.open() method is called

This avoids bug in IE and Android stock browser where setting
xhr.withCredentials before calling xhr.open() throws InvalidStateError.