Allow cross-domain requests in XMLHttpRequests. I should probably make it optional