The default is "strict" which might not work for cross-site AJAX
calls, so let's start by offering an option for customization, pending
further investigation.