middleware xhr domain