replace ajax with XMLHttpRequest add CORS filter