tag and bower
white list option to prevent CORS exceptions