Add support for CORS / XHR

This is ready to be looked over now.
Should this happen before success/error callbacks?