add same origin policy workarround