allow XHRs from file:/// URLs with the right flags