Adam's answer didn't work for me. However, the following did:
xhr.setRequestHeader('Authorization', ' ');
notice, second parameter is a string containing a space instead of empty space.
It does not remove header completely, but sets it to the empty string, which might be enough for some cases.