It's also used as part of the CORS handshake for cross-domain XHR calls.