add cross-domain-content permission