You need to include the appropriate sarissa javascript file in your webpage, for example sarissa_ieemu_xpath.js.
You need to include the defer attribute in the script tag, use inline scripting instead of remote file sources and keep all this within the head HTML tag.
When your page is using HTTPS, your XML-loading code (XMLHttpRequest or Document.load) should do the same.