add CORS support to bookmarklet (close #3)