allowing XHR