try solve cross-domain security with iframe for export