Imrpove prevent-xhr scriptlet; add trusted-prevent-xhr scriptlet

Add support for synchronous `send()` calls. `trusted-prevent-xhr` is essentially the same as `prevent-xhr` except that if the `directive` argument is not a known token, it will be used as is as the response text of the xhr request, whereas `prevent-xhr` returns an empty string when the directive is unknown.

Author: gorhill