Now found solution for cross domain policy

Added this to my .htaccess
Header add Access-Control-Allow-Origin "https://www.heavy.ch"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

and override the location of the fonts via my update.css file