* privileges added
* cors (F) and systemXHR (P) added
* changes in handling callbacks (all info is temporary)