fix cross domain origin policy issue