Only respond with js if .xhr? is true

Prevents user private data leak for GET requests from other domains
See discussion on rails-core mailing list
https://groups.google.com/forum/#!topic/rubyonrails-core/rwzM8MKJbKU