pretend that zombie allows cross-domain access