Add support for CORS / XHR

This is ready to be looked over now.
Need to unregister this handler on success or error. Otherwise the xhr will never get garbage collected (and we create a new xhr for very request).