RxJs 7 setting X-Requested-With by default when RxJs 6 did not

[driskell]

Describe the bug

Reraise of #6663

The X-Requested-With header is still getting set in v7 with default parameters to an AJAX call where with RxJs 6 it did not, constituting a breaking change when using with a server that does not support preflight requests but does correctly return an Access-Control-Allow-Origin.

I've enhanced the reproductions to try show it more clearly in the codepen.

Expected behavior

Default parameter AJAX call to a non-same-origin endpoint which does not support Preflight but does return the correct allow headers to succeed. In other words - do not send a custom header in the request.

Reproduction code

Working:
6.6.7: https://codepen.io/Driskell/pen/yLovOxK

Not working:
7.4.0: https://codepen.io/Driskell/pen/MWvQymO
7.5.2: https://codepen.io/Driskell/pen/PoJyRaz
7.5.4: https://codepen.io/Driskell/pen/jOaGbwX
7.5.6: https://codepen.io/Driskell/pen/poVyyLo
8.0.0-alpha.4: https://codepen.io/Driskell/pen/NWMNNYV

Reproduction URL

No response

Version

7.5.2

Environment

No response

Additional context

No response

[driskell]

I can see the last issue did cause some changes and it seems things are improved but I'm still getting lots of issues around this as it's still unexpected for X-Requested-With to get appended by default.

[driskell]

Was anyone able to examine this?

[driskell]

Hit this again with CORS as there's now an additional header in Access-Control-Request-Headers 😢

[driskell]

Still seeing the rogue header in latest 7 and the new 8 alpha

7.5.6: https://codepen.io/Driskell/pen/poVyyLo
8.0.0-alpha.4: https://codepen.io/Driskell/pen/NWMNNYV

[driskell]

@benlesh Did you have any thoughts on the above?