make xhr requests actually possible