fix same origin check