fixed cross domain security bug