playing with cross domain file upload