support JsonpRequest (bypass x-domain-call security)