call XMLHttpRequest.setRequestHeader() after XMLHttpRequest.open()