FIX: [security bug] XHR check bypass

This fixes the *security* bug reported in meta: [Security bug: XHR check bypass](http://meta.discourse.org/t/security-bug-xhr-check-bypass/6237)

This will **only** bypass the XHR check on `PUT`/`POST`/`DELETE` provided an api key is there **and** is valid.