use xdomain as a CORS polyfill for IE<=9; fixes #30