..but i guess you can control it if you're sending xhr from evil.com ?