Add support for CORS / XHR

This is ready to be looked over now.
Good point, everything I've been developing against has been ensuring IE8+ support and from a testing point of view I've only tested in IE8+.

It would be good to know the exact requirements of this as I'm not convinced what we've written will work as well with IE7- as it does with IE8 and may require teams develop a static (less / non) js fallback.