code: function createCORSRequest (method, url) {
          var xhr;
  
          xhr = new window.XMLHttpRequest();
  
          if ("withCredentials" in xhr) {
              // XHR for Chrome/Firefox/Opera/Safari.
              xhr.open(method, url, true);
  
          } else if (window.XDomainRequest) {
              // XDomainRequest for IE.
              if (_allowInsecureSubmissions) {
                  // remove 'https:' and use relative protocol
                  // this allows IE8 to post messages when running
                  // on http
                  url = url.slice(6);
              }
  
              xhr = new window.XDomainRequest();
              xhr.open(method, url);
          }
  
          xhr.timeout = 10000;
  
          return xhr;
      }
docs: Create the XHR object.