added cross-domain to app embed