Removed int()-casts in XHR controller

Removed some int()-casts in the XHR controller as the backend handles
both (and we avoid double validations). Also added a few missing
int()-casts with validation in the backend.

Fixed #423
Merge branch 'xhr_pass_through'