no custom headers for cross domain by default