Don't send HTML with edit links on XHR
CORS support against redirects
XHR requests for .html sends HTML
x-frames: DENY for all except bin output

Bin output uses SAMEORIGIN.
Don't send headers if they're not asked for
Merge pull request #1860 from jsbin/fix/1850

Fix XHR issues jQuery Mobile is seeing