adding CORS support (mainly for the FF addon since the xhr_wrapper is now dead).only works for resource:// URLs, so it should protect against any attacks.