title: Access-Control-Allow-Origin not checking in chrome extension
body: <p>As you know, when send $.ajax(..) request to another domain (cross-domain), most browser throw exception like:</p>
  
  <pre><code> XMLHttpRequest cannot load http://mysite.com/test.php. Origin
   http://127.0.0.1:8888 is not allowed by Access-Control-Allow-Origin.
  </code></pre>
  
  <p>I am creating chrome extension and it should send a request to my website. First , i expected to see above message,too. But i confused when i see it worked fine.</p>
  
  <p>First, It’s seem good, it’s working and i have what i want. But it can be horrible. Every one can use such way (only a simple script) to attack my site and grab its data.</p>
  
  <p>Of course, grabbing could be happen in other ways, too.
  I am new in api programing and chrome extension. Do anyone may show me the way?</p>
  
  <p>manifest.json</p>
  
  <pre><code>{
    "manifest_version": 2,
    "name": "MyTestExtension",
    "description": "this extension is for test",
    "version": "1.0",
    "icons": {
      "128": "icon.png"
    },
    "browser_action": {
      "default_icon": "icon.png" 
    },
    "permissions": [
      "tabs" ,
      "*://*/*"
    ],
    "content_scripts": [
      {
        "matches": ["*://*/*"],
        "js": ["jquery-1.7.2.min.js","content_script.js"],
        "run_at": "document_end"
      }
    ]  
  }
  </code></pre>
  
  <p>content_script.js</p>
  
  <pre><code>$(document).ready(function(){
      $('html').mouseup(function() {
          var selectedText = getSelectedText();
          if(selectedText &gt; ''){
              my_syncTest(selectedText)      // here : selected test send to my site
          }
      });
  
      function getSelectedText() {
          if (window.getSelection) {
              var selection = window.getSelection().toString();
              if(selection.trim() &gt; ''){
                  return selection;
              }
          } else if (document.selection) {
              var selection = document.selection.createRange().text;
              if(selection.trim() &gt; ''){
                  return selection;
              }
          }
          return '';
      } });
  
  
  function my_syncTest(word){
  var qs = 'word='+word+'&amp;header=555&amp;simwords=1'; 
  $.ajax(
    {
     type: "POST", 
     url: 'http://mysite.com/test.php',
     dataType: 'json', 
     data : qs, 
  
    success:function(res){
      console.log(res.success +" - "+ res.idWord + " - " + res.header +" - " + res.meaning);
    }});
  }
  </code></pre>