correct cross-origin-policy issues