Update cross-domain, and include api token in xhr token for GET usage.