SECURITY: Use different anon cache keys for XHR requests

XHR requests are handled differently by the application and the
responses do not have any preloaded data so the cache key needs to
differntiate between those requests.

spec/requests/application_controller_spec.rb

@@ -1256,6 +1256,41 @@ RSpec.describe ApplicationController do
         get "/", headers: { "HTTP_USER_AGENT" => "iam badcrawler" }
         expect(response.status).to eq(429)
       end
+
+      context "with XHR requests" do
+        before { global_setting :anon_cache_store_threshold, 1 }
+
+        def preloaded_data
+          response_html = Nokogiri::HTML5.fragment(response.body)
+          JSON.parse(response_html.css("#data-preloaded")[0]["data-preloaded"])
+        end
+
+        it "does not return the same preloaded data for XHR and non-XHR requests" do
+          # Request is stored in cache
+          get "/", headers: { "X-Requested-With" => "XMLHTTPrequest" }
+          expect(response.status).to eq(200)
+          expect(response.headers["X-Discourse-Cached"]).to eq("store")
+          expect(preloaded_data).not_to have_key("site")
+
+          # Request is served from cache
+          get "/", headers: { "X-Requested-With" => "xmlhttprequest" }
+          expect(response.status).to eq(200)
+          expect(response.headers["X-Discourse-Cached"]).to eq("true")
+          expect(preloaded_data).not_to have_key("site")
+
+          # Request is not served from cache because of different headers, but is stored
+          get "/"
+          expect(response.status).to eq(200)
+          expect(response.headers["X-Discourse-Cached"]).to eq("store")
+          expect(preloaded_data).to have_key("site")
+
+          # Request is served from cache
+          get "/", headers: { "X-Requested-With" => "xmlhttprequest" }
+          expect(response.status).to eq(200)
+          expect(response.headers["X-Discourse-Cached"]).to eq("true")
+          expect(preloaded_data).not_to have_key("site")
+        end
+      end
     end
   end