FIX: [security bug] XHR check bypass