Should XHR be blockable in request manager?

[hrj]

XHR requires JS, but if JS is enabled, there are many ways to send data to a remote server, by encoding them in URLs that are automatically fetched by the browser, such as CSS, Image or IFrame requests. XHR just makes it more convenient.

This raises two questions:

• Does it make sense to have a separate column for XHR?
• If the column exists can it be kept enabled by default? The JS will be disabled by default, making XHR effectively disabled by default.

Need advice from experts.