added code docs to function ilios.utilities.getXMLHttpRequest()
added "X-Requested-With" request header to requests using the "native" XHR object, so that CI can identify them as "AJAX" requests.
bugfix in authn. check hook: exit instead of return on unauthenticated xhr requests and requested filestreams.