JavaScript XHR origin tracking