Why Ajax call in Safari, xmlHttpRequest.open("POST", testURL, false, username, password), throwing Permission Denied error?

Following code is working well for IE and FireFox. But for Safari,
userCheckRequest.open("POST", checkURL, false, un, pw);
throws "Permission Denied" exception. This function  is called in the OWA, https://TestServer/exchange.
Any suggestions and solutions would be appreciated. Thanks.

// web applicaton, TestApp has a web method in XML Web Service, the url is,
//'https://TestServer/TestApp/ValidateUser.asmx/IsUserValid'
// following function calls the web method from OWA, 'https://TestServer/exchange'
function DoCheckUser()
{
    var ReturnXML =null;
    var checkURL = "https://TestServer/TestApp/ValidateUser.asmx/IsUserValid";
    var userCheckRequest;
      userCheckRequest = CreateXMLHTTP();

      try
      {
            var un = "testDomain\\testUser";
            var pw = "testPass";

            try
            {
                  userCheckRequest.open("POST", checkURL, false, un, pw);                        
            }
            catch (e)
            {
                  alert("Error 1 - " + e);
            }
            try
            {
                  userCheckRequest.send("");
                  if( !userCheckRequest.responseText )
                  {
                        return false;
                  }
                  ReturnXML=CreateXMLParser(userCheckRequest.responseText);
            }
            catch (e)
            {
                  alert("Error 2 - " + e);
                  return false;      
            }

            try
            {
                  if(!ReturnXML)
                  {
                        return false;
                  }
                  if(!ReturnXML.firstChild || !ReturnXML.firstChild.nodeValue)
                  {
                        return false;
                  }
                  returnVal = ReturnXML.firstChild.nodeValue;
                  if( returnVal == "true" )
                  {      
                        return true;
                  }
                  else
                  {
                        return false;
                  }
            }            
            catch(e)
            {
                  alert("Error 3 - " + e);
                  return false;      
            }
            return false;
      }            
      catch(e)
      {
            alert("Error 4 - " + e);      
            return false;      
      }
}

function CreateXMLHTTP()
{
      var objHttpRequest = "undefined";
      if (window.ActiveXObject)
      {            
            try
            {
                  objHttpRequest = new ActiveXObject("Msxml2.XMLHTTP");      
            }
            catch(e)
            {
                  objHttpRequest = new ActiveXObject("Microsoft.xmlhttp");
            }
      }
      else
      {
            try
            {            
                  objHttpRequest = new XMLHttpRequest();
            }
            catch(e)
            {
                  alert(e);                  
            }      
      }
      return objHttpRequest;
}

function CreateXMLParser(text)
{
      var x="undefined";
      var doc = null;
      if (window.ActiveXObject)
      {
            
            try{
                  doc = new ActiveXObject("Msxml2.DOMDocument");
            }
            catch(e)
            {
                  
                  doc=new ActiveXObject("Microsoft.XMLDOM");
            }            
            try
            {
                  doc.async="false";
                  doc.loadXML(text);
            }
            catch (e)
            {
                  alert( 'loading xml threw exception: ' + e );
            }
            
      }
      else
      {
            var parser=new DOMParser();
            doc=parser.parseFromString(text,"text/xml");
      }
      x = doc.documentElement;
      return x;
}