don't serve player controls for XHR

Added header "xhr: yes" to xhr_get. Now the server knows when not to
include player controls in the response for /play requests.