allow cross-domain fonts