SEC-2321: Refine to use X-Requested-With: XMLHttpRequest