Use XHR + POST for request if CORS supported

[benvinegar]

Fixes #412

[mattrobenolt]

I'm not an expert here, so lemme get this straight:

• You're checking for either XMLHttpRequest that has the proper support. Is XMLHttpRequest guaranteed to exist? I assume if it's undefined, we'll have an issue calling new XMLHttpRequest()
• Then falling back to checking for XDomainRequest, which is IE specific. This is great, but then inside makeXhrRequest, XDomainRequest isn't used or even attempted to be used. So it's not clear to me what good this check is doing.

[benvinegar]

Is XMLHttpRequest guaranteed to exist?

Realistically – yes, unless someone has removed it (e.g. the host page or a browser extension).

But I'll add the check.

Then falling back to checking for XDomainRequest, which is IE specific. This is great, but then inside makeXhrRequest, XDomainRequest isn't used or even attempted to be used. So it's not clear to me what good this check is doing.

Yep, that was a mistake.

[mattrobenolt]

Realistically – yes, unless someone has removed it (e.g. the host page or a browser extension)

What about the IE case though since they use XDomainRequest? Or do I misunderstand this?

[benvinegar]

What about the IE case though since they use XDomainRequest?

The XMLHttpRequest object still exists, and can be safely queried for presence of withCredentials.

[mattrobenolt]

Ah, ok. I see. IE's XMLHttpRequest object just isn't capable of issuing a CORS request.

[benvinegar]

I've tested / verified the latest version with a grab bag of browsers:

• Chrome 46
• Firefox 41
• IE10, IE11
• IE8, IE9 (XDomainRequest)
• Edge
• Safari 5
• Android 4.0.4 Stock Browser