allowing cross-site scripting with Access-Control-Allow-Origin