setting permissions for cross-site request