Allow XHR from app manifest