Don't allow fake XHR to step back to HEADERS_RECEIVED

I added a missing verification to stop `setResponseHeaders` from setting the `readyState` from 3 and 4 to 2. This fixes #402.