access origin to deny all external urls test