make a cross-domain call for testing Origin header (&minor whitespace fix)