allow ajax and CORS (firefox compatible)