relaxed CPS for XmlHttpsRequest