Whoa this is interesting.
Are you doing the XHR from inside a content script on a page?
Or are you doing the XHR from the background page?
Either way I would expect the cookies to be there. I haven't got to the XHR steps of my addon, does anyone know if cookies are available to XHR from background script, from content script? Does it need special permission in manifest.json?
(knowing when to give permission, and with what entry in the manifest, is a hard thing to find out, the only way I figure out is when I hit an unexpected block, I troubleshoot randomly and it usually ends up with some new key in the manifest)