xhr: Move cross-origin logic to request