Add support for XHR timeout.
This is marked as a P1 spec defect - it was felt during the EG Ajax meeting that
this lack of support for timeout was a critical failure.
A request that is unexpectedly long running, or a network timeout, can
completely freeze the client. Hence, the P1 status.