allow cross-domain requests for XML and JSON