removed unsafe setting of XMLHttpRequest