Move xhr.timeout after call to xhr.open

Required for Internet Explorer compatibility. See:
http://msdn.microsoft.com/en-us/library/ie/cc304105.aspx