yet another fiddle to avoid same-domain protection