allowed POST and GET over xorigin