added cross-origin to refresh