title: Javascript - XmlHttpRequest.Send with credentials (user name and password)
body: <p>xhr.open(...) with username and password works only when the script is at the same domain as the URI. This appears to be due to the so-called <em>same origin policy</em>. As one would note from this answer <a href="https://stackoverflow.com/questions/1652178/basic-authentication-with-xmlhttprequest#">here on StackOverflow</a>, one can send an explicit Authorization header with the xhr request, thus bypassing the <em>same origin policy</em>. </p>
  
  <p>The question is why do we then have this <em>same origin policy</em> that can, with little effort, be bypassed?</p>
  
  <p>Thanks in advance!</p>