switch to async response processing. document CORS challenges