Prevent setRequestHeaders from being called twice (like setRequestBody)

I added a missing verification to stop `setResponseHeaders` from setting the `readyState` from 3 and 4 to 2. This fixes #402.