Phew! finally XHR working, was blaming it on CORS, but it wasn't CORS, I was missing right permissions in manifest.json