new post: xhr auth over SSL from a non SSL origin using CORS