avoid origin policy issue 2