XHR/CORS/localStorage/content script