Add support for CORS / XHR

This is ready to be looked over now.
Is this really needed? I've removed it locally and jshint seems okay