Add support for CORS / XHR

This is ready to be looked over now.
L282 uses if (xhr) and this line uses if (this._hasXHR).

Should be consistent?