allows cross-domain communication from the browser