remove outdated XHR creation

The player was using IE5-esque creation of XHR in IE, which screwed up CORS. Neatly fixed by throwing away the compatibility code (which wouldn't help anyway as IE < 9 has no canvas support).