new version with cross-origin allowed