only allow cross-origin GET