cross-site http requests in your browser script