What's the point of the X-Requested-With header?

A good reason is for security - this can prevent CSRF attacks because this header cannot be added to the AJAX request cross domain without the consent of the server via CORS. Only the following headers are allowed across origins: Accept Accept-Language Content-Language Last-Event-ID Content-Type any others cause a "pre-flight" request to be issued in CORS supported browsers. Without CORS it is not