support CORS XHRs from chrome-extension