ajax setRequestHeader选项

The following is an interview question about AJAX. I am supposed to correct the code:

httpconn.open('POST','http://mysecondserver.com/listen/xxx.php',true,'username','password');

httpconn.setRequestHeader('Accept-Encoding','auto');
httpconn.setRequestHeader('Content-type', 'text/plain');
httpconn.setRequestHeader('Content-length', data.length);

httpconn.send(data);

I want to know is it possible to specify username and password in httpconn.open?

What about the setRequestHeaders? are they correct? I know for sure httpconn.setRequestHeader('Content-type', 'text/plain'); is correct. What about the other two?

thank you.

Username and password are valid:
http://en.wikipedia.org/wiki/XMLHttpRequest#The_open_method

According to W3C, the following headers are invalid and should throw an exception:
Content-Length, Accept-Encoding
http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method