Added authorization headers (app_id and app_key) to XMLHttpRequest