requiring CORS header breaks IE7 polyfill