i hate you same origin policy