allow cross-domain always to fix intermittent CORS (bug 1003005)