cors in ie8, fix #8