add cross-domain scripting