replace jsonp with allow-control.origin