Update xhr.coffee

Remove cross-domain restriction (warning! security issues)