fix cross-origin being blocked