Don't add X-CSRF-Token if request is cross domain

[bwittenbrook3]

Since there is no way to remove an element from the Access-Control-Request-Headers after you set the request header on the xhr object, we need to add in a check to not set the X-CSRF-Token when performing a cross domain request.

With this change, you can set the crossDomain: true property (as below) of an ajax call and it will not include the X-CSRF-Token, which would otherwise fail during the preflight response in applications that do not support that token as indicated by the Access-Control-Allow-Headers of their response.

$.ajax({
      ...
      crossDomain: true,
});

[freundchen]

+1
Will this be merged anytime?

[sansb]

@rondale-sc please merge