add another suggestion for cross origin policy