How would the condition be written to ensure a page is either accessed by xmlhttp request from my site or from an allowed outside domain?
Ajax requests are only possible from the same domain. You cannot make an XMLHttp request from another site due to inbuilt security reasons.
This site outlines states perfectly that you cannot launch a cross-domain XMLHTTPRequest http://developer.yahoo.com/javascript/howto-proxy.html
All modern web browsers impose a security restriction on network connections, which includes calls to XMLHttpRequest. This restriction prevents a script or application from making a connection to any web server other than the one the web page originally came from (Internet Explorer will allow cross-domain requests if the option has been enabled in the preferences). If both your web application and the XML data that application uses come directly from the same server, then you do not run into this restriction.