refactor cross domain policy