added to application controller to allow cross domain ajax