Reset request body when open() is called

[shannonbooth]

Otherwise the request body can leak into subsequent requests on the same XHR object.

• At least two implementers are interested (and none opposed):
  • Chrome/Webkit/Gecko already implemented
• Tests are written and can be reviewed and commented upon at:
  • This was found through the following WPT test https://github.com/web-platform-tests/wpt/blob/master/cors/simple-requests.htm
• Implementation bugs are filed:
  • Chromium: N/A
  • Gecko: N/A
  • WebKit: N/A
• MDN issue is filed: N/A
• The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

[annevk]

Thanks @shannonbooth, nice catch!