fixup: web fonts should be same-origin