The problem is that you are not encoding Base64 username (i.e. authentication token) and (dummy) password that you send (which is a requirement of the basic HTTP authentication scheme). Here's what your code should look like:
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://onsip.highrisehq.com/account.xml');
xhr.setRequestHeader('Authorization', 'Basic ' + btoa(token + ':'));
xhr.onreadystatechange = function() { console.log(xhr.responseText); };
xhr.send();
( 'onsip' , token .)