Hotfix: Add X-Requested-With as an allowed CORS header