clean up cross-origin request code