cross domain + basic http auth