only give crossdomain back for a url match