only use cross origin if coming from file