handle all sources, although won't work on quadpad because of missing access-control-allow-origin