Allow crossdomain in app.js