added cross domain permissions