XMLHttpRequest must be open before setting headers