Disable xmlhttprequest security in default controller