Either way a few things I'd suggest:
* Your code doesn't appear to have a scheme (http:// or https://) on the URL, is that a copy/paste issue or is that your actual code? If you're trying to access the same host, leave off the host name entirely (/sitecore/api/ssc/auth/login)
* Did you look at the Network panel in your browser Developer Tools? This is a much better way to debug the XHR request.
* Despite the code sample from the SSC docs, don't use XMLHttpRequest directly. I'd use fetch, with a polyfill if needed: css-tricks.com/.../
* Don't construct JSON as a string -- create an object and use JSON.stringify