fixes issue #37 - do not include X-Requested-With by default with CORS