Add XHR path for browsers that support CORS.

Helps with #28.