allow cross-domain cookie #2