Fixes #41 by checking x-requested-with header before triggering navigation

This commit adds header checks before triggering the `location:update` event in
`serverUtils.navigateCallback()`. If the request was made via AJAX, the
`x-requested-with` header will contain `XMLHttpRequest` and we can safely avoid
triggering the navigation event.

This prevents any browser from being redirected to a URL made via AJAX.

A test case is included alongside other ghost mode tests.