Added 'xhrOnly' policy