XHR wrapper works for relative urls as well

#Modification:
1. earlier support for GET csrf protection, for relative urls was
limited, now it works well