Don't set headers on XHR/API requests (except HSTS)

HSTS will still be sent on all requests.
XFO will be sent on non-xhr AJAX requests.
All other headers will not be applied to xhr/api requests.

"API request" is defined by the "format" parameter.