Fix cross-domain XHR

without the permision the XHR event only return:
Result from Cross-Domain XHR
Cross-Domain XHR failed

with the correct lines in manifest.webapp it shows properly