Imrpove prevent-xhr scriptlet; add trusted-prevent-xhr scriptlet

Add support for synchronous `send()` calls.

`trusted-prevent-xhr` is essentially the same as `prevent-xhr` except
that if the `directive` argument is not a known token, it will be
used as is as the response text of the xhr request, whereas `prevent-xhr`
returns an empty string when the directive is unknown.