add window.returnValue
debug cross domain
test Access-Control-Allow-Origin