Object.define -> Object.defineProperty
removed default x-requested-with due to CORS