Only allow cross domain on api