allow custom media download url for cross-origin domains