The way pnathan described his app, systemXHR doesn't seem to make sense for it. You usually only need systemXHR when you are writing an app that talks to a third-party server that you cannot control and that you cannot convince to enable CORS. systemXHR also has different handling of cookies and HTTP authentication credentials.
"permissions": { "systemXHR": {} }
https://developer.mozilla.org/en-US/docs/Apps/App_permission... Some info