limited cross domain request to UI application host