input: [Description of Mechanism] XMLHttpRequest and Access Control [Conforming User Agents] TBD; Firefox 3.next Reuses the same API as for single-domain invocations. There has been much discussion about whether or not this is confusing for mashup developers. See XMLHttpRequest and Access Control. [Security Considerations] 
output: Cookies and Auth (private data) can be sent with requests, and user is unaware that such requests are taking place Risk that Data Site will opt in on URLs which serves user-private data without realizing that URL will leak private data. Technical discussions within W3C WG context continue.