remove callback.js reference, add header to enable cross-comain