[XHR] Authorization header

Per the current XHR spec draft, the Authorization header cannot be set  
from JavaScript for security reasons.

As far as I know, no shipping browser blocks it - and when we started  
blocking it in WebKit, it caused a compatibility problem, <https://bugs.webkit.org/show_bug.cgi?id=24957 
 >.

What is the security reason to block this header?

- WBR, Alexey Proskuryakov