add ajax limitations and circumventing same origin