Allow all origin for access control to allow XSS