A pure JavaScript CORS alternative