fix htaccess cross domain leak