workaround chrome iOS XHR+CSP bug