gistfile1.txt

$.ajaxSetup({
    xhrFields: {
        withCredentials : true  // allow FF to send auth cookie
    },
    headers: {
        "X-Requested-With" : "xmlhttprequest"  // tell server we're ajax
    }
});

Catalyst example in Root->auto()

# always set CORS headers so we can use the API cross-domain
# use explicit Origin from request since some clients (FF)
# do not like a wildcard *
my $res = $c->res;
$res->header(
    'Access-Control-Allow-Methods' => 'GET,PUT,POST,DELETE,OPTIONS' );
$res->header( 'Access-Control-Allow-Credentials' => 'true' );
$res->header( 'Access-Control-Allow-Origin' =>
        ( $c->request->header('Origin') || '*' ) );
$res->header( 'Access-Control-Allow-Headers' =>
        'Content-Type, X-Requested-With, Origin, Accept, *' );

Worth noting that the .ajax call needs to be async otherwise Firefox will whine at you and give:

Exception... "A parameter or an operation is not supported by the underlying object", as noted here:

http://stackoverflow.com/questions/16677893/evil-firefox-error-a-parameter-or-an-operation-is-not-supported-by-the-under