more defensive xhr check; fixes #130