ajax origins made configurable