FIX: [security bug] XHR check bypass

This fixes the security bug reported in meta: [Security bug: XHR check bypass](http://meta.discourse.org/t/security-bug-xhr-check-bypass/6237)

This will **only** bypass the XHR check on `PUT`/`POST`/`DELETE` provided an api key is there **and** one is defined in the site settings **and** the provided api key is matching it.

I leave it to @SamSaffron for further inspection.