call http api with same origin policy