fix cross domain issue with download attribute