add CORS support for IE8/9