fix for cross-domain origin handling