Only would happen if ajax.php is overridden and CORS is active (multi-domain login).

odd. I don't remember having CORS activated. I'll check and disable it if it is since I don't need it.

If you run across multiple-domains then the browser will automatically use CORS and Composr will automatically respond to it.

The fix is to move the cms_srv function from global3.php to global2.php.

A workaround is to remove the backdoor_ip line from _config.php (it can't be there at all, not even blank).

Ah okay that makes sense then. I added a require_code on my end and it fixed the issue.

I think you mean moving/copying the require_code('global3') further up in init__global2. That should work, the only reason I didn't is a small performance hit for the requests we've made to not need it.