Implement XHR permissions