systemXHR *is* a privilege, more than an entirely new API. Calling it out that way makes more sense to me, especially to those unfamiliar. This way people don't just gloss over "systemXHR" (which is a horribly named attribute to expose anyway) and instead see it's something their app can have. Then they might actually explore the documentation.