set crossDomain = false in ajaxSetup is bad

[flisky]

The docs suggest this -

$.ajaxSetup({
    crossDomain: false, // obviates need for sameOrigin test
    beforeSend: function(xhr, settings) {
        if (!csrfSafeMethod(settings.type)) {
            xhr.setRequestHeader("X-CSRFToken", csrftoken);
        }
    }
});

However, people need to set corssDomain = true if there is a crossDomain request under some circumstances.
(In my case, I use CORS with server responsed with 'Access-Control-Allow-Origin' and no 'Access-Control-Request-Headers')

Actually, jQuery does this more intelligently:
default: false for same-domain requests, true for cross-domain requests

And jQuery set the crossDomain value before calling beforeSend, so I propose this:

$.ajaxSetup({
    beforeSend: function(xhr, settings) {
        if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
            xhr.setRequestHeader("X-CSRFToken", csrftoken);
        }
    }
});

[Tim Graham <timograham@…>]

In 0be4d64487537fe5fe220cfb8896c4da08bb22a8:

Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

[Tim Graham <timograham@…>]

In d29f3b9e878c10417d66e1542ac52fe2ca242cf8:

[1.4.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master

[Tim Graham <timograham@…>]

In d4a3fd44f04fd06252ccfdd001772daa35c510d1:

[1.6.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master

[Tim Graham <timograham@…>]

In 427f218a5ecec315a18583c1013e315d9102d6d3:

[1.7.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master

[Tim Graham <timograham@…>]

In ce06ef5569705ab4a7c0a495deb7fe5efb63c153:

[1.5.x] Fixed #22859 -- Improved crossDomain technique in CSRF example.

Thanks flisky for the report.

Backport of 0be4d64487 from master